ToolHazard: Scaling Adversarial Environments for Security Evaluation and Alignment of LLM-Based Agents

Large language model LLM agents integrated with external tools are vulnerable to indirect prompt injections embedded in environmental states. However, existing studies largely rely on manually implemented or reused environments, stochastic LLM-based tool simulation, and predefined injection...

CVE-2026-73245

Kestra, an open-source event-driven orchestration platform, prior to 2.0.0-rc6 exposed Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env to disclose resolved configuration and POST /loggers/{...

EUVD-2026-56898

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-71845 Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-73217

The CVE describes a sandbox-escape flaw in Cursor IDE for macOS prior to 3.1.2. An agent in Auto-Run Sandbox mode can replace a virtual environment’s Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, enabling arbitrary host commands with t...

CVE-2026-73217 Cursor: Sandbox escape via tampered Python virtual environments

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...

CVE-2026-73083

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

EUVD-2026-56551

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

GHSA-CC2G-26RW-G997 Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-596p-6jv8-775v. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and...

Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-596p-6jv8-775v. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and...

Malicious code in @openzeppelin-4/contracts (npm)

@openzeppelin-4/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v4 line via the look-alike scope @openzeppelin-4, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

MAL-2026-13737 Malicious code in @openzeppelin-4/contracts (npm)

@openzeppelin-4/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v4 line via the look-alike scope @openzeppelin-4, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

MAL-2026-13738 Malicious code in @openzeppelin-5/contracts (npm)

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v5 line via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

CVE-2026-72782

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

CVE-2026-72782

CVE-2026-72782 affects Craft CMS versions 5.0.0-RC1–before 5.10.6 and 4.0.0-RC1–before 4.18.2. The underlying issue is that environment variables and secrets (via ${ENV_VAR}) can be interpolated into Twig templates during rendering, even with the Twig sandbox enabled. An authenticated attacker wi...

CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

EUVD-2026-56106

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...