CVE-2026-79761 Termix: Command injection in SSH key deployment verification

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

CVE-2026-79761 Termix: Command injection in SSH key deployment verification

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

CVE-2026-79761 Termix: Command injection in SSH key deployment verification

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

CVE-2026-75907 CVE-2026-75907

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

EUVD-2026-86156

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

CVE-2026-75907

The door access control system on Norwegian Cruise Line assets is vulnerable to improper authentication because it grants entry based solely on the static 7-byte UID of an NTAG212 NFC chip . Since the UID is a manufacturer serial number sent in the clear and lacks challenge-response capabilities ...

EUVD-2026-85933

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

CVE-2026-92680 Araxis Merge insufficiently protected credentials

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

CVE-2026-92680

Araxis Merge for Windows versions 2011.4074 through 2026.0 are vulnerable to insufficient protection of user-configured credentials for remote servers. The software stores these credentials in the Windows registry without applying adequate cryptographic protection. An authenticated, non-administr...

CVE-2026-92680 Araxis Merge insufficiently protected credentials

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

Araxis Merge

RISK EVALUATION Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative user could retrieve and unencrypt other users'...

Malicious code in simple-date-formatter-new-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...

MAL-2026-17161 Malicious code in simple-date-formatter-new-15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b96d3c3d5f1a071c40a8b72ea22b5e0221db32cfffacfc8f2343f0ee97eb0 The package's package.json postinstall script curls cloud instance-metadata endpoints AWS IMDS at 169.254.169.254/latest/meta-data/sts-credential,...

MAL-2026-17158 Malicious code in simple-date-formatter-new-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042 Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script...

Malicious code in simple-date-formatter-new-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042 Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script...

CVE-2026-94416 Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore

AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl Report, commits identified as AI-assisted are leaking secrets at approximately twice the rate of...

CVE-2026-67221

A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers URIs with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the...

CVE-2026-92680: Insufficiently Protected Credentials

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

PT-2026-97871

Name of the Vulnerable Software and Affected Versions Araxis Merge for Windows versions 2011.4074 through 2026.0 Description The software stores user-configured credentials for remote servers in the Windows registry without applying sufficient cryptographic protection. This allows an authenticate...