Malicious code in @dsp-next-gen-ui/needs-review (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d60392260c683ff8714400794f5f621a8c040ba0846b9fabdd194c0e6fb76b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @caspianph/first-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a101ff8ca989c2598cab444a54d3518cecc3a385934f97b7cb1ce36ea4fb6761 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14006 Malicious code in priority-mutex-lane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd0cb794e1b53c6b4c63bdd456196771029c0c003a33694581dadd3707acf0e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors

NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...

GHSA-5PQ8-3FFP-7W5M hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

DEBIAN-CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

EUVD-2026-57826

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

CVE-2026-73622 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-121)

Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without...

PT-2026-71699

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The API scope middleware incorrectly classifies the 'GET /api/v1/user/actions/runners/registration-token' endpoint, as well as its owner- and repository-level...

PT-2026-71868

Name of the Vulnerable Software and Affected Versions IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 IBM Storage Scale versions 6.0.0.0 through 6.0.1.0 Description Sensitive information may be exposed within the log files of the IBM Storage Scale Management GUI. Specifically, the administrato...

PT-2026-73166

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-73519

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

CVE-2026-73519

WolfStack before version 25.9.2 contains a hard-coded cluster-authentication secret compiled into builds (src/auth/mod.rs). Attackers can bypass require_auth() by sending the secret in the X-WolfStack-Secret header, without a session, API key, or user account. From a management port, an attacker ...

CVE-2026-19017

A flaw was found in Consul. A privileged attacker with operator:write permission can exploit a partial arbitrary file read vulnerability when Consul is configured to use the Vault Connect CA provider with JWT or AppRole authentication. This allows the attacker to direct Consul to read and forward...