GHSA-G6XQ-892H-64W3 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

BIT-COMPOSER-2026-45793 Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...

CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

EUVD-2026-46092

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594

Summary: CVE-2026-53594 affects FreeScout (PHP/Laravel) where the App Logs viewer can read arbitrary server files due to a flawed path resolution in the rap2hpoutre/laravel-log-viewer override. Before v1.8.224, the code accepts any existing absolute path prior to applying the storage/logs restric...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering ...

CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header len == sizeofstruct xfstransheader, xlogrecoveraddtotrans adds an item but no region, leaving it on ritemq...

PT-2026-61709

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594: Improper Limitation of a Pathname to a Restricted Directory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

OESA-2026-3098 cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package. Security Fixes: A flaw was found in Cockpit. Deleting a sosreport with a crafte...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4shell-scanner A dependency-free, defensive scanner for...

GO-2026-5935 netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil

netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil...

CVE-2026-49834

Technical details for CVE-2026-49834 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-47183

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.excinfo...

CVE-2026-47183 Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.excinfo...