26532 matches found
CVE-2026-56864
Technical details about CVE-2026-56864 are not publicly available in the provided documents; monitor for updates.
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
CVE-2026-56865
Technical details about CVE-2026-56865 are not publicly available in the provided documents. Monitor for updates.
GO-2026-6179 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
GO-2026-6180 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
CVE-2026-19483
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...
CVE-2026-17481
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs...
CVE-2026-19483 The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...
EUVD-2026-58476
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...
CVE-2026-19483
CVE-2026-19483 affects IBM Storage Scale GUI: 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 can disclose secrets (admin password) via GUI logs and exception information. The vulnerability stems from sensitive data being written to log files in the Management GUI. CVSSv3.1 base score 7.1 (HIGH), vector LV:L...
EUVD-2026-58458
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs...
CVE-2026-72667
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...
Malicious code in external-process-live-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751 The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 with a 'bearrtoken: logo...
MAL-2026-13960 Malicious code in process-live-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a36d35f64443b9dc4a2395017b8738562a321c9765089f916eeebdf58281d57 The default export getPlugin issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 and passes the returned...
Malicious code in process-live-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a36d35f64443b9dc4a2395017b8738562a321c9765089f916eeebdf58281d57 The default export getPlugin issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 and passes the returned...
CVE-2026-66443
Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...
CVE-2026-28185
Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...
hashi-vault-js: Vault token and secret values exposed in thrown errors
Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...