CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

CVE-2026-75010: Incorrect Resource Transfer Between Spheres

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...

CVE-2026-47669

CVE-2026-47669 (DbGate Zip Slip) : The unzipDirectory function in DbGate’s API path traversal allows writing files outside the target directory via ZIP entries with “..” (Zip Slip), enabling arbitrary file writes and potential RCE, especially in default Docker deployments running as root. Impact ...

CVE-2026-12566: Server-Side Request Forgery (SSRF)

The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...

RageAgainstThePixel/setup-steamcmd leaked authentication token in job output logs

Summary Log output includes authentication token that provides full account access Details The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves...

PT-2025-30356 · Undefined · Undefined

🔴 Steam, Authentication Token Leak, CVE-2021-30405 Critical https://t.co/HJCAq0A62N...

CVE-2024-53859 go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace

go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...

CVE-2024-24941: Improper Input Validation

In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL...

CVE-2022-31130: Exposure of Sensitive Information to an Unauthorized Actor

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...