73431 matches found
CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...
EUVD-2026-94637
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...
CVE-2026-107232
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...
CVE-2026-107232
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...
CVE-2026-107232 AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...
EUVD-2026-93993
Backstage: Improper input validation in Sentry scaffolder actions...
CVE-2026-107176 Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operat...
Backstage has a sensitive information disclosure in Kubernetes resource queries
Impact An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources...
Backstage: Improper preservation of access restrictions during service credential delegation
Impact An external service credential configured with access restrictions e.g., read-only could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugi...
EUVD-2026-94059
Backstage: Sensitive information exposure in Scaffolder...
CVE-2026-106502
A flaw was found in the Backstage plugin-scaffolder-backend component. Under specific template and failure conditions, Scaffolder task failure events can expose sensitive backend-managed credentials. An authenticated user can exploit this vulnerability to retrieve credentials used during task...
CVE-2026-76483
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...
CVE-2026-62252
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
Exploit for Insecure Default Initialization of Resource in Raspberrypi Raspberry_Pi_Os_Lite
CVE-2021-38759 — Raspberry Pi OS Default Credentials Exploit...
Backstage may expose sensitive information in Scaffolder task failure events
Impact Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution. Patches Patched in @backstage/plugin-scaffolder-backend version 4.1.0...
GHSA-95P4-VV4G-JXXM Backstage may expose sensitive information in Scaffolder task failure events
Impact Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution. Patches Patched in @backstage/plugin-scaffolder-backend version 4.1.0...
EUVD-2026-94060
Backstage may expose sensitive information in Scaffolder task failure events...
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
Summary When property-file/Map-based ConnectionFactory setup fails while parsing the uri key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. Details...
EUVD-2026-93777
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load...
GHSA-H6W7-QMCM-Q6XR RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
Summary When property-file/Map-based ConnectionFactory setup fails while parsing the uri key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. Details...