CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

GO-2026-6508 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc...

CVE-2026-98113

A flaw was found in the Linux kernel's ksmbd server. An authenticated remote client can cause a Denial of Service DoS by sending requests containing multiple unmapped Security Identifiers SIDs within a Discretionary Access Control List DACL. Because the server logs each mapping failure without ra...

CVE-2026-93262

A flaw was found in the Linux kernel. A local attacker can cause a Denial of Service DoS or potentially escalate privileges through a use-after-free vulnerability in the RAID-5 Partial Parity Log PPL component. During flush operations, the system improperly continues to access an input/output I/O...

CVE-2026-84501

A flaw was found in Apache ZooKeeper. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a specially crafted request containing newline characters. This vulnerability allows the attacker to forge complete log entries, including timestamps, log...

CVE-2026-84648

A flaw was found in Jenkins. The system log viewer does not properly escape log record metadata, such as the source, level, and timestamp. This vulnerability allows attackers who control agent processes to inject malicious scripts. Successful exploitation can lead to a stored cross-site scripting...

CVE-2026-102332: Improper Limitation of a Pathname to a Restricted Directory

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

PT-2026-102394

Name of the Vulnerable Software and Affected Versions Dozzle versions prior to 11.1.2 Description Insufficient sanitization of container display names occurs when building ZIP archive entry names in the log download endpoint. Attackers with the ability to label containers can employ path traversa...

PT-2026-99785

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A remote SQL injection is possible through the manipulation of the log type argument within the getData function located in the /www/server/panel/class/data.py file. SQL injection is a techniq...

GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

log-sentinel

log-sentinel !CIhttps://github.com/07espigares/log-sentin...

BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-15273

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

CVE-2026-15273

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in version 4.0.0 . The root cause is insufficient input sanitization and output escaping related to the REQUEST_URI . This flaw allows unauthenticated attackers to inject arbitrary web scripts, which execute...

CVE-2026-15273 Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

CVE-2026-15273 Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

EUVD-2026-87526

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

PT-2026-99236

Name of the Vulnerable Software and Affected Versions Automatic.css version 4.0.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via the REQUEST URI variable. This allows the injection of arbitrary web...

CVE-2026-15273: Improper Neutralization of Input During Web Page Generation

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

CVE-2026-96879 "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0...