PYSEC-2026-432 OpenStack Nova logs sensitive context from notification exceptions

An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...

PT-2026-53660

Name of the Vulnerable Software and Affected Versions Parseable versions prior to 2.9.2 Description An information disclosure issue exists in the notification-target API endpoints where webhook tokens and basic-auth credentials are returned in cleartext. This occurs because the secret-masking...

CVE-2026-58050

creationtimestamp| type| source ---|---|--- 2026-06-28 05:35:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpdauuqzkh2o 2026-06-28 08:29:56+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mpdkms5yf726 2026-06-29 02:55:09+00:00| seen|...

PT-2026-53227

Name of the Vulnerable Software and Affected Versions WsgiDAV versions prior to 4.3.5 Description The sample MySQLBrowserProvider in wsgidav/samples/mysql dav provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. This occurs within the exists record by...

CVE-2026-9242

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN callback handler...

EUVD-2026-39949

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN callback handler...

CVE-2026-9242 RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN callback handler...

CVE-2026-9242

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN callback handler...

PT-2026-53059

Name of the Vulnerable Software and Affected Versions RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login versions prior to 6.0.8.7 Description An authentication bypass exists due to insufficient verification of data authenticity. The PayPal IPN callback...

GHSA-WW5P-J6CJ-6MQQ Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

Summary The GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials — Cloudflare API tokens, TencentCloud SecretKeys, Slack/Discord/Telegram webhook URLs with embedded bot tokens, and Authorization header values — withou...

GHSA-7VFX-4246-JCFH SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings

Summary Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to access, modify, or delete other users' API tokens and notification transport settings. The root cause is that LiveComponent actions accept entity IDs without verifyi...

EUVD-2026-32861

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: gitlab-runner, terragrunt, cloudflared, crossplane-provider-aws-ec2, crossplane-provider-aws-lambda, skaffold, witness, crossplane-provider-aws-sqs, prometheus-operator, gitlab-pages, spire-server, tkn, pulumi-kubernetes-operator, zarf, prometheus,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gitlab-runner, terragrunt, skaffold, witness, prometheus-operator, spire-server, tkn, pulumi-kubernetes-operator, zarf, prometheus, crossplane-provider-azure-storage, istio, policy-controller, nfpm, fulcio, step-kms-plugin, docker, dagger, kine, steampipe,...

SUSE CVE-2026-53167

In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSENOTIFYRETRIEVE to uptodate folios FUSENOTIFYRETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSENOTIFYRETRIEVE is intended to only return data that is already in...

PT-2026-57344

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions prior to 2.2.5 Description The software fails to redact sensitive information when returning resource objects. Authenticated administrators or Personal Access Tokens PAT with nezha:ddns:read or nezha:notification:read...

GO-2026-5687 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification in github.com/nezhahq/nezha

Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification in github.com/nezhahq/nezha...

GO-2026-5647 free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) in github.com/free5gc/nef

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure attacker-controlled notifyUri in github.com/free5gc/nef...

GO-2026-5598 Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join in github.com/daytonaio/daytona

Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join in github.com/daytonaio/daytona...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...