Windows Event Logging Service Information Disclosure Vulnerability

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

Windows Event Logging Service Information Disclosure Vulnerability

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...

PT-2026-70858

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue allows an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings. Instead of affecting only the intended database, these changes...

PT-2026-70406

Name of the Vulnerable Software and Affected Versions Windows Event Logging Service affected versions not specified Description A race condition exists in the Windows Event Logging Service. This occurs when concurrent execution using a shared resource lacks proper synchronization, allowing an...

CVE-2026-18702: Improper Privilege Management

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...

PT-2026-70416

Name of the Vulnerable Software and Affected Versions Windows Event Logging Service affected versions not specified Description The use of an uninitialized resource in the Windows Event Logging Service allows an authorized attacker to disclose information locally. Recommendations At the moment,...

CVE-2026-18710: Insertion of Sensitive Information into Log File

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

CVE-2026-61347: Buffer Over-read

Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-59137: Use of Uninitialized Resource

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

PT-2026-70936

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

PT-2026-70420

Name of the Vulnerable Software and Affected Versions Windows Event Logging Service affected versions not specified Description A buffer over-read in the Windows Event Logging Service allows an authorized attacker to disclose information locally. A buffer over-read occurs when a program reads mor...

CVE-2026-59126: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed,...

CVE-2026-68199 wifi: ath6kl: fix OOB access from firmware ADDBA window size

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggrrecvaddbareqevt logs a debug message when the firmware-supplied winsz is outside AGGRWINSZMIN, AGGRWINSZMAX but does not return. The out-of-range winsz is then used...

Malicious code in chaintest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence...

CVE-2026-19363 lmammino oidc-authorizer Lambda Authorizer handler.rs log file

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

PT-2026-69305

Name of the Vulnerable Software and Affected Versions lmammino oidc-authorizer versions prior to 0.4.1 Description The Lambda Authorizer component contains an issue where raw Authorization header values and complete bearer tokens or JWTs are logged on authentication failure paths, potentially...

CVE-2026-16608

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's...

CVE-2026-16608: Missing Authorization

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's...

Logging of Excessive Data

Overview jupyterhub is a JupyterHub: A multi-user server for Jupyter notebooks Affected versions of this package are vulnerable to Logging of Excessive Data via the login process. An attacker can exhaust logging and storage resources by submitting invalid input with excessively large or numerous...