271 matches found
CVE-2026-59386
A flaw was found in Cloud Foundry Controller CAPI. An authenticated user with SpaceSupporter permissions can improperly modify an application's start command or buildpack configuration, operations that should require elevated privileges. This privilege escalation can allow the unauthorized...
CVE-2026-59388
Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...
CVE-2026-59388 Cloud Controller exposes secrets in audit log
Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...
CVE-2026-59388
Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...
CVE-2026-59388 Cloud Controller exposes secrets in audit log
Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...
CVE-2026-59388
The Cloud Controller (CAPI) for Cloud Foundry suffers from a vulnerability where sensitive secrets are leaked into audit logs. Specifically, custom buildpack credentials are exposed during application manifest application, creation, and updates. Additionally, syslog drain URL credentials are leak...
EUVD-2026-113754
Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...
CVE-2026-59388: Cloud Foundry Foundation: Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are…
Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...
PT-2026-133313
Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...
Linux kernel security vulnerabilities
A security vulnerability exists in the Linux kernel. It stems from dm-crypt failing to reject entries in the “capi:” table where AEAD passwords are paired with the lmk IV mode e.g., capi:gcmaes-lmk with integrity:28:aead. Additionally, lmk sets tfmscount to 64, while cryptalloctfmsaead allocates...
Malicious code in moveworks-capi-starter (PyPI)
Source: kam193 2cd8f99409a87f01743f65f381fefa800176a29d47d6119743ae2bd0ce1f7583 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...
MAL-2026-18122 Malicious code in moveworks-capi-starter (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...
Malicious code in moveworks-capi-starter (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...
Malicious Package
Overview moveworks-capi-starter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
CVE-2026-59388 - Cloud Controller exposes secrets in audit log | Cloud Foundry
Severity High CVSS score: 6.5 Medium CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.248.0 inclusive Description Credentials for custom buildpacks leaked into audit events of type...
CVE-2026-59385 - Space Developer can extract space-scoped broker credentials | Cloud Foundry
Severity High CVSS score: 2.7 Low CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.247.0 inclusive Description A SpaceDeveloper could configure the url of a space-scoped broker without changin...
CVE-2026-59386 - credential exposure to space supporter | Cloud Foundry
Severity Medium CVSS score: 6.4 Medium CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.247.0 inclusive Description A SpaceSupporter could change the start command and buildpack of an...
Astra Linux – Vulnerability in Linux, Linux 5.10
A issue was discovered in the Linux kernel before version 5.14.15. There is a flaw where the array index exceeds the bounds in the detachcapictr function located in drivers/isdn/capi/kcapi.c...