CVE-2026-19502

CVE-2026-19502 affects MongoDB SQL Schema Builder CLI. The issue is insufficient redaction of sensitive startup/connection configuration in diagnostic output (stdout and log files), allowing a local user with access to terminals or logs to view authentication material. The documentation provided ...

CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-16694 IBM i is Affected By Stored Cross-site Scripting for i

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-68448

A flaw was found in the Linux kernel's overlayfs component. When copying files across different overlay filesystems, the system incorrectly checked read permissions using the destination filesystem's credentials instead of the source's. This oversight could allow an unauthorized user to read file...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

EUVD-2026-57265

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

MAL-2026-13806 Malicious code in egypt0811 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d31e1b5baa802662cbb61387f5c3b759d159e74e8776d9515198db5c168074 The package contains only index.html declared as main with no JavaScript modules, no lifecycle scripts preinstall/install/postinstall, and no bin...

MAL-2026-13816 Malicious code in hxckdoeaqjlc8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324cd3fd06a0d97ae5fb9263df818bc505d28ebcdda8e90814b5630de70e108 The package ships a single HTML file that impersonates Cloudflare's 'Just a moment...' interstitial. On Turnstile widget callback, embedded JavaScrip...

Malicious code in mnhdjoweuq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 095b631b3ea82334aa5d3ffb4c015340670beebb533d0e016023d997a3ce7e56 Package contains only package.json and index.html, with main pointing at the HTML file. index.html mimics a Cloudflare Turnstile 'Just a moment'...

Malicious code in hcfguyfrmblp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f806fc6db71a1b888ba1f86d790b7a2866b4911e7f77ade2d375237e8c0a6ea2 The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page mimics a Cloudflare...

MAL-2026-13808 Malicious code in fghvbmniwu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8623e3b9a84e8cbe5910bc3d683f19629c49b9d3f0a2e00ab771901efef8146a Package contains a single index.html declared as main, which is a Cloudflare-branded 'Just a moment...' clone embedding a Turnstile widget and heavil...

MAL-2026-13802 Malicious code in dhjksficgwu2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5dc64d0022ee36cd898963db50e3c835990bf94837821fb34408820855c69c0 Package contains a single index.html file declared as main. The HTML impersonates a Cloudflare Turnstile 'Just a moment...' verification page sitekey...

MAL-2026-13801 Malicious code in cxcbdjxcmncvfg2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0caba01ec3b437a50e1808290e06ae0d084836e6660a0fe90ad56e8cd80b0338 The package contains a single index.html that visually impersonates a Cloudflare 'Just a moment...' challenge page including a spoofed Ray ID and...

CVE-2026-68868

The CVE covers the Google Cloud Secret Manager backend in Apache Airflow’s Google provider where the team scope is not applied when resolving Connections and Variables. This flaw allows a task or DAG in one team to resolve another team’s secret name, exposing credentials in multi‑team deployments...

CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...

Sensitive Information Disclosure

Apache Camel Netty HTTP component is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of exception responses, where processing errors return full Java stack traces instead of suppressing them, allowing attackers to obtain sensitive information such as...

CVE-2026-12233

The PSA Protected Storage credential backend subsys/net/lib/tlscredentials/tlscredentialstrusted.c declared its credential-store mutex as a plain zero-filled static struct kmutex credentiallock; and never called kmutexinit on it. A statically zero-filled kmutex has an uninitialized wait queue its...

CVE-2026-12233 Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention

The PSA Protected Storage credential backend subsys/net/lib/tlscredentials/tlscredentialstrusted.c declared its credential-store mutex as a plain zero-filled static struct kmutex credentiallock; and never called kmutexinit on it. A statically zero-filled kmutex has an uninitialized wait queue its...

CVE-2026-12233

CVE-2026-12233 affects the PSA Protected Storage TLS credential backend. The credential_store mutex was declared as a zero-initialized static k_mutex and never initialized, leaving its wait queue NULL. Under contention, z_pend_curr() appends to this uninitialized wait queue and dereferences a NUL...