PT-2026-60110

Summary Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint. Details Requests under /configfiles/raw/appId/clusterName/namespace...

PT-2026-59613

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

PT-2026-60034

Summary RepetitionsConfigViewSet and MaxRepetitionsConfigViewSet return all users' repetition config data because their get queryset calls .all instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Details...

PT-2026-59176

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30. Affected by this issue is the function sanitize env lines of the file hermes cli/config.py. The manipulation results in injection. It is possible to launch the attack remotely. The attack requires a high level of...

PT-2026-59243

Summary StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask principal.Permission. init with zero Needs when their config flags are unset. Both flags defaulted to False in code prior to the fix, so this was the state of any Lemur install that hadn't explicit...

PT-2026-59620

Summary The set config value API endpoint allows users with the non-admin SETTINGS permission to modify any configuration option without restriction. The reconnect.script config option controls a file path that is passed directly to subprocess.run in the thread manager's reconnect logic. A SETTIN...

PT-2026-59350

Vulnerability Type: Information Disclosure / Missing Authentication Severity: Medium Component: backend/open webui/routers/retrieval.py — get status GET / Affected Endpoint: GET /api/v1/retrieval/ Affected Version: Open WebUI main branch — confirmed unpatched through v0.9.2 Authentication Require...

BIT-AIRFLOW-2026-48892 Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in sensitiveconfigvalues, so the masker did not redact...

MAL-2026-10215 Malicious code in fast-dotenv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3250a4b69ccce49128d2e75ffb9e577746de4fb3afe0e0d242fbe5d094d02d The package presents itself as a.env loader but on load/config spawns a background thread that, after a 72–96 hour activation delay jittered by...

Malicious code in react-next-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286869faf09aec1d62b472e43a7188a1583c5cf8c999d1fb2e116f0b7f5ba8c6 The package impersonates the pino logger README/badges reference pino; module.exports.pino is the middleware while its name is react-next-vite. When ...

MAL-2026-10211 Malicious code in react-next-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286869faf09aec1d62b472e43a7188a1583c5cf8c999d1fb2e116f0b7f5ba8c6 The package impersonates the pino logger README/badges reference pino; module.exports.pino is the middleware while its name is react-next-vite. When ...

Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

Fedora 44 : log4cxx (2026-43767b6007)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-43767b6007 advisory. Update to log4cxx 1.7.0. New features: fallback-ref appender attribute, Qt CMake findpackage component, TelnetAppender NonBlocking option. Bug fixes: non-ASC...

CVE-2026-61454

CVE-2026-61454 affects Grav's Admin2 plugin prior to 2.0.4. The vulnerability arises from embedding a global JavaScript variable, window.GRAV_CONFIG , in the Admin2 SPA bootstrap page at /grav/admin and subroutes. This object is returned in every unauthenticated response and exposes server URL, A...

CVE-2026-61454 Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

The Grav Admin2 plugin getgrav/grav-plugin-admin2 before 2.0.4 embeds a global JavaScript variable window.GRAVCONFIG in the Admin2 SPA bootstrap page at /grav/admin and its subroutes. This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base...

EUVD-2026-43184

The Grav Admin2 plugin getgrav/grav-plugin-admin2 before 2.0.4 embeds a global JavaScript variable window.GRAVCONFIG in the Admin2 SPA bootstrap page at /grav/admin and its subroutes. This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base...

OpenC3 COSMOS - Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

Summary COSMOS reads configuration from a user-writable overlay targetsmodified/ before the read-only plugin-installed targets/ tree, and the config subsystem executes code on those files: ConfigParser renders every file as ERB by default, a GENERICREADCONVERSION / GENERICWRITECONVERSION block is...

Malicious code in polymarket-mcp-v2 (npm)

polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on npm install. It steals Solana keypairs, .env secrets and other credential files, and installs an attacker-controlled SSH key into /.ssh/authorizedkeys, then opens port 22 for persistent access. Any...

CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-57475

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access an...