EUVD-2026-87526

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

PT-2026-99236

Name of the Vulnerable Software and Affected Versions Automatic.css version 4.0.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via the REQUEST URI variable. This allows the injection of arbitrary web...

CVE-2026-15273: Improper Neutralization of Input During Web Page Generation

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...

CVE-2026-96879 "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0...

EUVD-2026-87271

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

CVE-2026-67406 RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2...

CVE-2026-85290

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...

CVE-2026-85290

In versions prior to 1.7.2 , the InvoicePlane application is vulnerable to Log Injection due to unsanitized user input in the Cron::recur() method. The application fails to neutralize CRLF characters when writing an invalid cron_key from the URL path into the application log. An unauthenticated r...

CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...

EUVD-2026-87123

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...

CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...

CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...

Microsoft Office Information Disclosure Vulnerability

Insertion of sensitive information into log file in Microsoft Office allows an authorized attacker to disclose information over a network...

AZL-104607 CVE-2026-98113 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

CVE-2026-98113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

CVE-2026-98003

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 "iommu/amd: Simplify and Consolidate Virtual APIC AVIC Enablement" moved the GA log allocation from iommuinitpci to enableiommusvapic, which is called on...

UBUNTU-CVE-2026-98113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

UBUNTU-CVE-2026-98003

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 "iommu/amd: Simplify and Consolidate Virtual APIC AVIC Enablement" moved the GA log allocation from iommuinitpci to enableiommusvapic, which is called on...

CVE-2026-98113

The Linux kernel contains a vulnerability in ksmbd where a client can include multiple structurally valid but unmapped SIDs in a DACL. This allows an authenticated client to generate hundreds of kernel error messages per request by triggering mapping failures, potentially leading to a kernel log ...

CVE-2026-98113 ksmbd: rate limit unmapped SID errors

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...