1071 matches found
CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
PT-2026-66499
Name of the Vulnerable Software and Affected Versions OpenCost versions prior to 1.121.0 Description Authentication is not properly enforced for the 'GET /helmValues' endpoint, which exposes the base64-decoded HELM VALUES environment variable containing cloud provider credentials. Furthermore, th...
CVE-2026-16481
A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...
CVE-2026-47695 CC-Tweaked has an SSRF Protection Bypass with NAT64
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API http.request, http.websocket blocks requests to private network ranges to prevent server-side request forgery SSRF. This protection can be bypassed ...
CVE-2026-12715
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
EUVD-2026-45187
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
PT-2026-60778
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
GHSA-38H5-PJW3-MQXF vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-3VVP-54WC-F6JR vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-WVXF-4P9H-5VG9 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-JHVQ-4R2H-7C2Q vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-XX4X-7C38-RPQ3 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
CVE-2026-43095 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
CVE-2026-45945 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
CVE-2026-53260 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-RGJ9-VX7J-X86J vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-M424-X6WR-WWGW vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-5MCX-8CMV-FVGX vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...