32950 matches found
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: xfs: Fixed undersized liclogroundoff values. If the superblock does not list a log stripe unit, we set the incore log roundoff value to 512. This can lead to corrupted logs and unmountable file systems in generic/617 on a disk...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: nilfs2: A potential hang occurred in nilfsdetachlogwriter. Syzbot reported a potential hang during nilfsdetachlogwriter called when nilfs2 unmounts the file system. Analysis revealed that this issue arises because nilfssegctorsyn...
Astra Linux – Vulnerability in Zabbix
Setting the SMS media allows for setting the GSM modem file. This file is later used as a Linux device. But since everything is a file for Linux, it’s possible to set another file, such as a log file. In this case, Zabbixserver will attempt to communicate with it as a modem. As a result, the log...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel up to version 6.2.7, fs/ntfs3/inode.c contains an invalid kfree function because it does not validate the MFT flags before replaying logs...
EUVD-2026-102149
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...
CVE-2026-111096
The JetBrains TeamCity software is affected by a stored Cross-Site Scripting (XSS) vulnerability in the classic build log component. This flaw exists in versions prior to 2026.2 , 2026.1.4 , and 2025.11.8 . The vulnerability allows for potential impact on confidentiality and integrity. No specifi...
CVE-2026-111096
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...
CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...
CVE-2026-63442
Prior to version 26.1.11 , OPNsense is vulnerable to a log forgery flaw due to the unauthenticated WebGUI login usernamefld accepting carriage-return and line-feed characters. These characters survive LOG_AUTH processing and are injected into the syslog-ng destination feeding the lockout_handler....
CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...
io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing
A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...
CVE-2026-47790
The QuFTP Service is affected by a Cross-Site Scripting (XSS) vulnerability. A remote attacker who has already obtained a user account can exploit this flaw to inject malicious code. The vulnerability is mitigated in QuFTP Service versions 1.4.6 , 1.5.5 , and 1.6.5 and later. No specific informat...
CVE-2026-104618
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
CVE-2026-104618 sdbootutil: world-readable debug log
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
CVE-2026-104618
The sdbootutil script creates a debug log at /var/log/sdbootutil.log with world-readable permissions. This misconfiguration allows arbitrary low-privileged users on the system to access and extract sensitive secrets from the log file. No specific remediation or exploit details are provided in the...
EUVD-2026-101945
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...
CLEANSTART-2026-HL90010 Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node
Security vulnerability affects the opentelemetry-collector-contrib package. Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node...
PT-2026-115310
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.11.1 Description Multi-team provisioning in the Apache Airflow Keycloak provider allows every team role to have global read access to audit logs. This occurs within the attach team...
CVE-2026-100347: Improper Input Validation
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...
CVE-2026-106707: Improper Neutralization of Input During Web Page Generation
XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...