WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

The Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006634)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006634 advisory. In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITSPERLONG The code in dm-log rounds up bitsetsize...

Dell ObjectScale和Dell Elastic Cloud Storage 日志信息泄露漏洞

Dell ObjectScale and Dell Elastic Cloud Storage are products of the American company Dell. Dell ObjectScale is an object storage platform. Dell Elastic Cloud Storage is a large-scale storage platform. Versions of Dell Elastic Cloud Storage 3.8.1.7 and earlier, as well as Dell ObjectScale versions...

PT-2026-31304

Name of the Vulnerable Software and Affected Versions Dell Elastic Cloud Storage versions 3.8.1.7 and prior Dell ObjectScale versions prior to 4.1.0.3 and version 4.2.0.0 Description Dell Elastic Cloud Storage and Dell ObjectScale contain a flaw where sensitive information may be inserted into lo...

Red Hat OpenShift Mirror Registry 代码问题漏洞

Red Hat OpenShift Mirror Registry is a lightweight container image repository service provided by Red Hat Corporation. There are code-related vulnerabilities in Red Hat OpenShift Mirror Registry. These vulnerabilities allow authenticated users to utilize the log export feature to provide custom...

IBM Tivoli Netcool Impact 日志信息泄露漏洞

IBM Tivoli Netcool Impact is a suite of network management software from International Business Machines IBM. The software has the ability to automate business-critical functions and provide a platform that provides unified access to real-time data, events and indicators. IBM Tivoli Netcool Impac...

PT-2026-31301

Name of the Vulnerable Software and Affected Versions CoolerControl/coolercontrol-ui versions prior to 4.0.0 Description A stored cross-site scripting XSS issue exists in the log viewer of CoolerControl/coolercontrol-ui. An unauthenticated attacker can compromise the service by injecting maliciou...

PT-2026-31056

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006768)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006768 advisory. In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2logdocheckpoint Both jbd2logdocheckpoint and...

PT-2026-31330

Name of the Vulnerable Software and Affected Versions mirror-registry affected versions not specified Description An issue exists in mirror-registry where authenticated users can exploit the log export feature by providing a specially crafted web address URL. This allows the application's backend...

CVE-2026-35452

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin. The log contains internal filesyste...

CVE-2026-35391

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP function in lib/admin/session.ts trusted the first leftmost entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to...

CVE-2026-39368

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege...

CVE-2026-39368

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege...

CVE-2026-39368 WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege...

CVE-2026-39368 WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege...

CVE-2026-39368

WWBN AVideo (open-source video platform) variant CVE-2026-39368 affects version 26.0 and prior. The Live restream log callback feature accepts an attacker-controlled restreamerURL, which is fetched server-side, enabling stored SSRF. This allows a low-privilege user with streaming permission to st...

CVE-2026-39368 WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege...

EUVD-2025-209264

Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application...

CVE-2026-33405

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a...