CVE-2026-66027

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66005

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

MAL-2026-11049 Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...

Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...

EUVD-2026-40455

electron-updater: Cross-origin redirect leaks PRIVATE-TOKEN and mixed-case Authorization credentials in builder-util-runtime...

EUVD-2026-48594

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729 Loytec LWEB802: Exposure of Sensitive Information in browser localStorage

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729

The CVE-2026-55729 entry concerns Loytec LWEB802 (before 5.0.8) where a vulnerability in the browser localStorage can expose management credentials. An unauthenticated remote attacker can leak credentials via a crafted link. Product: Loytec LWEB802; component: browser localStorage; root cause: in...

Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

MAL-2026-11048 Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

CVE-2026-14172

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...

CVE-2026-54422

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...

DEBIAN-CVE-2026-54422

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...

UBUNTU-CVE-2026-54422

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...

CVE-2026-54422

CVE-2026-54422 affects OpenStack Ironic Python Agent up to and including 11.5.0. A malicious boot container deployed via ironic-python-agent can extract the credentials used to download it, enabling credential disclosure on a local attacker. The CVSS metrics indicate a LOCAL attack vector with HI...