CVE-2026-108751

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...

CVE-2026-108728

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...

EUVD-2026-96916

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...

CVE-2026-108751 MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...

CVE-2026-108751

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...

CVE-2026-108751 MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...

CVE-2026-108751

The MoAI-ADK software, versions through 3.1.2 , is susceptible to an improper link resolution (CWE-59) vulnerability within the moai init template deployer . The root cause is the application's failure to properly resolve links during the staging process, allowing malicious repositories to utiliz...

CVE-2026-108751 MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...

CVE-2026-108728 Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...

CVE-2026-108728 Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...

CVE-2026-108728

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...

CVE-2026-108728 Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...

EUVD-2026-96894

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...

PT-2026-110153

Name of the Vulnerable Software and Affected Versions MoAI-ADK versions prior to 3.1.3 Description An improper link resolution issue exists in the moai init template deployer. This allows malicious repositories to overwrite files outside the project directory by using a symlinked .moai-tmp stagin...

CVE-2026-108751: Improper Link Resolution Before File Access

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...

CVE-2026-108728: Cleartext Storage of Sensitive Information

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...

Everyone’s AI MoAI-ADK backend link vulnerability

The All-Users AI MoAI-ADK 3.1.2 and earlier versions have a post-link vulnerability. This vulnerability stems from improper link resolution in the moai init template deployer. Attackers can use symbolic links to the.moai-tmp temporary path to overwrite files outside of the project, causing...

CLSA-2026-1791533950 cloud-init: Fix of 4 CVEs

CVE-2024-6174: fix platform enumeration by changing default policy of ds-identify to disallow discovery of datasources without strict identifiable - CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands - CVE-2023-1786:...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:22035-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22035-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs...

CVE-2026-107615

An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init and ThemeLib load screenhooks32.dll / screenhooks64.dll with LoadLibrary using a bare fi...