Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.2.13

Logging for Red Hat OpenShift - 6.2.13 Red Hat OpenShift Logging 6.2.13 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs...

UBUNTU-CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

Improper Output Neutralization for Logs

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the audit logging...

CVE-2026-2380

On affected platforms running Arista EOS with OpenConfig-related services i.e., gNMI, gNSI, RESTCONF and NETCONF, sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming vi...

CVE-2026-2380 Security Advisory 0168

On affected platforms running Arista EOS with OpenConfig-related services i.e., gNMI, gNSI, RESTCONF and NETCONF, sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming vi...

EUVD-2026-80313

On affected platforms running Arista EOS with OpenConfig-related services i.e., gNMI, gNSI, RESTCONF and NETCONF, sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming vi...

CVE-2026-89838: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as a length plus a fixed-size iname buffer. The buffer is not NUL-terminated, but recoverinode and recoverdentry print it with %s. For a 255-by...

CVE-2026-73442: Insertion of Sensitive Information into Log File

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs or a system receiving forwarded log output to obtain the peer devic...

Linux Distros Unpatched Vulnerability : CVE-2026-89838

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as a length plus a fixed-size iname buffer. The buffer is not...

EUVD-2026-79941

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-92237

The Devolutions PowerShell Universal software, versions 2026.2.5 and earlier , is vulnerable to the insertion of sensitive information into log files via the slow query logging feature . On instances backed by Microsoft SQL Server , this flaw allows an authenticated user with log read permissions...

CVE-2026-92003

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other...

CVE-2026-92003 MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other...

CVE-2026-92003 MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other...

CVE-2026-92002 MISP: Authentication failure logging suppressed during Redis unavailability

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

EUVD-2026-78432

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

CVE-2026-92002 MISP: Authentication failure logging suppressed during Redis unavailability

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

CVE-2026-92002

MISP versions ≤2.5.45 use Redis to throttle repeated authentication-failure log entries. The root cause lies in the _shouldLog() method: when User->setupRedis() returns false (i.e., Redis is unreachable), the throttle check suppresses all log writes, effectively silencing authentication-failur...

CVE-2026-92002 MISP: Authentication failure logging suppressed during Redis unavailability

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

CVE-2026-91859

Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, accessMonitor calls AccessLog::logRequest twice for one...