In-Spectre-Meltdown

In-Spectre-Meltdown このツールは、多くの最新プロセッサおよびオペレーティングシステムの設計に影響を与える投機的実行サイドチャネル攻撃をチェックするためのものです。CVE-2017-5754（Meltdown）およびCVE-2017-5715（Spectre）により、非特権プロセスが特権プロセスから機密情報を盗み出すことが可能になります。これらの攻撃は、CPU上のデータ保護対策を侵害する3つの異なる方法を提供し、攻撃者が本来読めないデータを読み取ることを可能にします。...

CVE-2026-27886-check

CVE-2026-27886 漏洞评估工具 安全检测 Strapi 实例是否受 CVE-2026-27886 影响，无需执行完整的账户接管流程。详见 Bishop Fox 博客上的 完整分析。 描述 CVE-2026-27886 是 Strapi 版本 4.0.0 至 5.36.1 中的一个未认证参数清理绕过漏洞，允许远程未认证攻击者通过公共内容 API 泄露管理员机密。框架中的查询清理器 @strapi/utils 仅处理已记录的 filters、sort、fields 和 populate 查询键，而静默保留请求中所有其他顶级键。这些未知键随后会通过...

git-alerts

GitAlerts どのような問題を解決するのか？ GitHubリポジトリは、組織の下に作成されたものはGitHub管理者が制御できます。しかし、組織のユーザーアカウントの下に作成されたリポジトリは、組織がGitHub Enterprise Managed User EMU モデルを採用していない限り、制御できません。 組織のユーザーアカウント下にある公開リポジトリで、誤って作成されたりテスト目的で作成されたものは、シークレット、内部情報、コードなどを漏洩させる可能性があります。GitAlertsはそのようなケースを検出し、監視するのに役立ちます。 例 管理者が制御可能...

dracon-utilities

Dracon Utilities Three small Rust CLI tools that look after a Linux development machine: one keeps your git repos committed and backed up, one keeps your disk and memory from falling over, and one stops secrets from landing in your git history. They run as ordinary user-level systemd services — n...

yolo-cage

yolo-cage: 害を及ぼさない自律コーディングエージェント あなたは責任あるエンジニアです。最も機密性の高いシステムやコードベースをAIに好き勝手にさせたりはしません。 だからこそ、Claude Codeのようなツールの安全機構を決して 無効にしたりしません。危険な操作ごとに許可を求めてくるので安全です！ そこで待ち、応答します。やがて判断疲れが訪れます。そしてそれが起こるのです。 許可プロンプトはスレッドモデルの最も弱い部分、つまり疲れたユーザーを見落としています。エージェントに力を与えつつ爆発半径を制限し、判断をPRレビューまで先送りできたらどうでしょう？...

CVE-2026-73834

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

CVE-2026-73834

A flaw in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes allows ACM wrapper Custom Resources that embed Secret data to be collected without redaction . When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archiv...

CVE-2026-74876

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876

In openssl_encrypt before 1.4.0, PublicKeyBundle.from_dict() accepts untrusted key bundle data without signature verification. Attackers can craft a malicious bundle, call to_identity(), and encrypt secrets to an attacker-controlled public key, enabling confidential data exfiltration. CVSS 9.8 cr...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

GHSA-5PQ8-3FFP-7W5M hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

EUVD-2025-210715

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM...

EUVD-2026-55698

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret...

CVE-2026-68870

The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a...

Astra Linux – Vulnerability in Node.js

A flaw in Node.js’s buffer allocation logic can expose uninitialized memory when allocations are interrupted, especially when using the vm module with the timeout option. Under certain timing conditions, buffers allocated using Buffer.alloc and other TypedArray instances like Uint8Array may conta...

CVE-2026-19264

Postiz is an open-source social media scheduling tool affected by CVE-2026-19264. The vulnerability arises in the route that serves locally stored media, which concatenates URL path segments into the upload directory and streams files without proper path normalization or directory confinement. UR...

SUSE CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...