Lucene search
+L

13545 matches found

Github Security Blog
Github Security Blog
added 2026/08/12 3:18 p.m.21 views

Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Summary The target search endpoint POST /api/latest/fleet/targets returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply th...

6.5CVSS5.5AI score0.00251EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/08/12 3:16 p.m.12 views

CVE-2026-66016

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

6.7CVSS5.2AI score0.00089EPSS
SaveExploits0References3Affected Software1
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.8 views

PT-2026-71123

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

6.7CVSS5.2AI score0.00089EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/12 12:00 a.m.9 views

MAL-2026-13933 Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

5.7AI score
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.9 views

PT-2026-71116

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

6.5CVSS5.3AI score0.00388EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/08/11 7:24 p.m.44 views

CVE-2026-71468 Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

5.3CVSS0.00259EPSS
SaveExploits0References8
ATTACKERKB
ATTACKERKB
added 2026/08/11 6:33 p.m.50 views

CVE-2026-18703

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

4.2CVSS5.3AI score0.00115EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2026/08/11 6:17 p.m.13 views

CVE-2026-48771

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

8.2CVSS0.00209EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/11 5:20 p.m.39 views

CVE-2026-48771 ishankportfolio: Stored Contact Form Submission Exposure via Public Client-Side Database Configuration

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

8.2CVSS0.00209EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/11 3:32 p.m.5 views

GHSA-W36C-QXRQ-V7FW Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references. Original Description Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code...

8.8CVSS6.5AI score
SaveExploits0References3
OSV
OSV
added 2026/08/11 12:17 p.m.16 views

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

8.7CVSS6.5AI score
SaveExploits0References4
CVE
CVE
added 2026/08/11 12:17 p.m.59 views

CVE-2026-72778

Summary: CVE-2026-72778 affects Craft CMS 4.x (from 4.0.0-RC1 up to 4.18.2) and 5.x (from 5.0.0-RC1 up to 5.10.6). The vulnerability is an authenticated remote code execution in the control panel element-search condition handling. The root cause is that Condition::createCondition() decodes and me...

8.8CVSS6.4AI score0.00447EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/11 12:16 p.m.12 views

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

7.5CVSS8.2AI score0.00352EPSS
SaveExploits0References9
RedHat Linux
RedHat Linux
added 2026/08/11 12:15 p.m.9 views

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

7.5CVSS8.3AI score0.00352EPSS
SaveExploits0References9
RedHat Linux
RedHat Linux
added 2026/08/11 11:39 a.m.11 views

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

7.5CVSS8.3AI score0.00352EPSS
SaveExploits0References9
Microsoft CVE
Microsoft CVE
added 2026/08/11 8:03 a.m.15 views

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

...

2.3CVSS5.2AI score0.00163EPSS
SaveExploits0
OSV
OSV
added 2026/08/11 12:00 a.m.13 views

MAL-2026-13776 Malicious code in upshift-config (npm)

upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk. The version 0.5.14 is fabricated to imply a release history the package does not have it is a first-ever publish. Its body is byte-identical to augustdigital-s...

5.4AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/11 12:00 a.m.19 views

Malicious code in upshift-config (npm)

upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk. The version 0.5.14 is fabricated to imply a release history the package does not have it is a first-ever publish. Its body is byte-identical to augustdigital-s...

5.3AI score
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/08/11 12:00 a.m.10 views

PT-2026-70796

Name of the Vulnerable Software and Affected Versions ishankportfolio versions prior to 1.0.1 Description Contact form submissions may be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database...

8.2CVSS5.2AI score0.00209EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/10 5:34 p.m.12 views

EUVD-2026-55681

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

9.9CVSS5.8AI score0.00763EPSS
SaveExploits0References3
Rows per page
Query Builder