screenscrub

screenscrub 在截图中查找凭据，将其提取到密钥管理器，并不可逆转地将它们从图像中隐去——这样秘密就不会在你的笔记、截图和 /Desktop 中腐烂。 本地。离线。静默。默认无网络、无遥测。 screenscrub 连接了两个现有的工具类别：GUI 隐去工具（Xnapper、Shhshot、macshot）手动模糊 PII，但无法区分秘密与地址，也无法捕捉它们隐藏的内容；秘密扫描器（gitleaks、TruffleHog）能发现真实的凭据，但仅限于文本，从未出现在 PNG 中。screenscrub 将 gitleaks...

vault-conductor

🗝️ vault-conductor 一个 SSH Agent，用于提供以密钥形式存储在 Bitwarden Secrets Manager 中的 SSH 密钥。 支持 SSH 认证和 Git 提交签名。 演示 功能特性 它以 Unix 域套接字服务器形式实现 SSH Agent 协议，作为你的 SSH 客户端与 Bitwarden Secrets Manager 之间的安全桥梁。 其特性包括： Agent 生命周期 ：以守护进程（后台）或前台进程方式运行，监听位于 /tmp/vc-$whoami-ssh-agent.sock 的 Unix 套接字 密钥懒加载 ：SSH 密钥仅在请求时通过...

teller

:computer: Nunca dejes tu terminal por los secretos :pager: Crea flujos de trabajo fáciles y limpios para trabajar con entornos en la nube :magright: Escanea en busca de secretos y combate la dispersión de secretos Teller: el gestor de secretos universal de código abierto para desarrolladores Nun...

CVE-2026-68868

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...

EUVD-2026-57163

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...

CVE-2026-68868

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...

CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...

CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...

CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...

SUSE-RU-2026:2816-1 Recommended update for python-aioresponses, python-google-api-core, python-google-api-python-client, python-google-auth, python-google-auth-httplib2, python-google-cloud-appengine-logging, python-google-cloud-artifact-registry, python-google-cloud-audit-log, python-google-cloud-build, python-google-cloud-compute, python-google-cloud-core, python-google-cloud-dns, python-google-cloud-domains, python-google-cloud-iam, python-google-cloud-kms, python-google-cloud-kms-inventory, python-google-cloud-logging, python-google-cloud-run, python-google-cloud-secret-manager, python-google-cloud-service-directory, python-google-cloud-spanner, python-google-cloud-storage, python-google-cloud-vpc-access, python-google-crc32c, python-google-resumable-media, python-googleapis-common-protos, python-grpc-google-iam-v1, python-grpc-interceptor, python-mmh3, python-mypy, python-opentelemetry-resourcedetector-gcp, python-poetry-core, python-proto-plus, python-pytest-asyncio, python-syrupy, python-typed-ast, python-uritemplate, python-dnspython, python-trio, python-websocket-client

This update for python-aioresponses, python-google-api-core, python-google-api-python-client, python-google-auth, python-google-auth-httplib2, python-google-cloud-appengine-logging, python-google-cloud-artifact-registry, python-google-cloud-audit-log, python-google-cloud-build,...

Malicious Package

Overview google-cloud-secret-manager-config-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious code in @cloudplatform-single-spa/secret-manager (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Empty Password in Configuration File

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Empty Password in Configuration File through the GoogleSecretManagerV1AccessStrategy in the...

MAL-2026-3309 Malicious code in google-cloud-secret-manager-config-poc (npm)

Malicious npm package published by the microsop threat actor as part of a dependency-confusion campaign that impersonates internal tooling at Microsoft, Google Cloud, and PayPal using inflated semver values e.g. 99.9.x, 100.1.x to win npm resolution against private internal packages. All packages...

MAL-2026-3000 Malicious code in xinference (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d006f6a08c959393160456d4ace221fd165b6d609fc8356ebfb041979aef93d Versions 2.6.0, 2.6.1, 2.6.2 were compromised. Following a malicious pull request that exfiltrated sensitive data from the CI runner, three malicious PyPI...

CVE-2025-54428 RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow...

CVE-2025-54428

CVE-2025-54428 affects RevelaCode prior to 1.0.1. A valid MongoDB Atlas URI with embedded credentials was committed to the public repository, enabling potential unauthorized access to production or staging databases and possible data exfiltration, modification, or deletion. The issue is resolved ...

AWS, Google, and Azure CLI Tools Could Leak Credentials in Build Logs

New cybersecurity research has found that command-line interface CLI tools from Amazon Web Services AWS and Google Cloud can expose sensitive credentials in build logs, posing significant risks to organizations. The vulnerability has been codenamed LeakyCLI by cloud security firm Orca. "Some...

envoy/server_fuzz_test: Heap-use-after-free in std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<std:

Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5761881319407616 Project: envoy Fuzzer: libFuzzerenvoyserverfuzztest Fuzz target binary: serverfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...