CVE-2026-68970

The apache-airflow-task-sdk is vulnerable to Cleartext Storage of Sensitive Information due to improper masking of Variable contents. When a JSON value is a list at the top level, the Task SDK fails to mask it, as masking was only implemented for strings and dictionaries. This allows any authenti...

PT-2026-71132

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The Task SDK fails to mask the contents of a Variable when its JSON value is a list. This occurs because masking is only applied to deserialized values that are strings or dictionaries, leavin...

netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...

netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...

Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance

Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-44249 Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior...

Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

MAL-2026-13496 Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

AZL-95468 CVE-2026-64652 affecting package gh for versions less than 2.97.0-1

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

DEBIAN-CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

UBUNTU-CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

PT-2026-68763

Name of the Vulnerable Software and Affected Versions GitHub CLI gh versions prior to 2.97.0 Description The gh auth status command improperly masks certain token types, specifically fine-grained personal access tokens github pat , GitHub App installation and user access tokens ghs , ghu , and th...

MAL-2026-13343 Malicious code in ethers-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 153163572a9fdf26e63ad50dd80b9fc3a28b22e89dea3e82acbd23a7ed7b265b The package is a typosquat of @ethersproject/abstract-signer. On require of the main module, index.js reads the full process.env plus hostname,...

MAL-2026-13336 Malicious code in dolyame-boxy-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6 On require of dolyame-boxy-markdown, index.js loads ext.js which downloads a platform-specific native binary from author-controlled Cloudflare Worker...

Malicious code in bnpl-blocks-consts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede Package is advertised as a constants wrapper but requiring it loads polyfill.js, which on import asynchronously downloads a platform-specific...

Malicious code in claims-block-visibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6afd966a220b14c0d01a2132af36d206eee200ab806d61443b66379e560b324 On require'claims-block-visibility', index.js loads polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint,...

MAL-2026-12617 Malicious code in claims-format-masked-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque...

Malicious code in claims-format-masked-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque...

CVE-2026-71260

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...

CVE-2026-71260 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...