CVE-2026-23958

DataEase (open-source data visualization tool) prior to version 2.10.19 uses the MD5 hash of the user password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin password by abusing unmonitored API endpoints that verify JWT tokens. The vuln...

EUVD-2026-4206

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints...

CVE-2026-23958 DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints...

CVE-2026-23958 DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints...

CVE-2026-23958 DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints...

CVE-2026-22822

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

Impact Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently include arbitrary files/directories outsid...

CVE-2026-22822

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, ha...

CVE-2026-0622

Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...

Cryptographic Weakness

Elliptic is vulnerable to cryptographic weakness. The vulnerability is due to incorrect byte-length computation and truncation of the RFC 6979 deterministic nonce k when it contains leading zeros, which results in faulty signatures and allows an attacker, under certain conditions, to derive the...

MAL-2026-434 Malicious code in weaviate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229f83d7066881287b7035e8e71dc5ed74531480ab19cbf47ebd72990bc1525 The package weaviate-js was found to contain malicious code. Source: ghsa-malware bb063c82675f5933564b46d7e49a2c2a7aac395d9a399b1264e3de0aafb29905 An...

MAL-2026-427 Malicious code in replicate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84c6cb090eb31f1b2c516b45419d7833bca83f5546d22444032d28a07d27f40 The package replicate-js was found to contain malicious code. Source: ghsa-malware 658bf1d6aa22bb672e5ae9724e34b94ee7ff73e7cd4381ff4a6a8c9c2d1267fa A...

Malicious code in babel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9ff5d2308ea7b49b6fbf0f4e49dd88fe66d82523ae39b56d2c8ce3747e64c7 The package babel-js was found to contain malicious code. Source: ghsa-malware 971a7cbc4a8fb219a47c89b6aa15c980a6d562786f2800c575eb250f53e229e1 Any...

MAL-2026-430 Malicious code in storage-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2793f12e0ee779bcb14e4a4a5198059f576c8f832a64238e1584d6b2cd34209 The package storage-types was found to contain malicious code. Source: ghsa-malware 43db13077851634493e5c8eded5eb06487ff41dcb7dad90ab9a2e3101e14b323...

Malicious code in nanoid-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad39f50bf85a03002a528aac3cf53797c47e72d196c7e0f9b92623e03088abf The package nanoid-js was found to contain malicious code. Source: ghsa-malware b20b5d4f24d425723aaaf45603909066d5983fe5341afba20f47d091f7ac0933 Any...

Malicious code in debox-rn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c6316f21d7f4cc37cd04a537f7a26d6350f3212ac81ec7a7abe85512bdf64e4 The package debox-rn was found to contain malicious code. Source: ghsa-malware 3b1937a110a1a3babb2ae74750bc429ca28e901fcc7b3b02d822ef2f4911e1b3 Any...

MAL-2026-411 Malicious code in collaborate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ebbe8909025711e34022d8c3556eac89c554324e133deb4b5fea65acbc33ef6 The package collaborate was found to contain malicious code. Source: ghsa-malware 4497ac6f05c2ec9a7b4b2328613c2fe85d955300a510ecaca8427c13d952a217 An...

Malicious code in oce-collaborate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8f69f2284ec7835136d41eb191227cc52ebfeafd3b33c0f7ce2d94ffd24cb88 The package oce-collaborate was found to contain malicious code. Source: ghsa-malware c217eb60fb78e5a6fde1b59cd586b4ad864bd1ad9cde77d6b50a79341d4d58d...

MAL-2026-423 Malicious code in oce-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cc6b17601336bdff3872b33d794187edf7b7a3779e96d01d0eb1081e043ecf5 The package oce-validate was found to contain malicious code. Source: ghsa-malware 4e0413e75c3bcfe39d1a45db99c6ac3968db6c708667e30eb88879f9fd483331 A...