CVE-2026-12695 miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...

CVE-2026-12695

The miniOrange 2FA WordPress plugin (versions before 6.2.6 ) is vulnerable to a two-factor authentication (2FA) bypass . The root cause is that the plugin fails to validate the submitted one-time password against the victim's stored secret, instead verifying it against an attacker-supplied value ...

CVE-2026-12695 miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-55502

Cloudreve prior to version 4.17.0 contains an OAuth scope bypass in the admin storage policy route POST /api/v4/admin/policy/oauth/signin. The admin route is under RequiredScopes(Admin.Read) and does not apply the local Admin.Write guard used by sibling policy mutation routes, allowing an attacke...

SUSE CVE-2025-2842

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be...

SUSE CVE-2025-64171

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

SUSE CVE-2026-8634

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit...

PT-2026-66831

Name of the Vulnerable Software and Affected Versions vault-secrets-webhook versions prior to 1.23.1 Description The software reads the vault.security.banzaicloud.io/vault-addr annotation from ConfigMaps or Secrets without validation or allowlisting. When a value prefixed with vault: is present,...

OpenBao secret encryption management system Privilege Escalation

The vulnerability of the OpenBao encryption and secret management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

OpenBao Secret Encryption Management System DoS

The vulnerability of the OpenBao encryption and secret management system is related to the occurrence of interpretation conflicts. Exploiting this vulnerability can allow an attacker to cause a service failure...

Malicious code in fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6432be2aefc6715127bc533a383c361b15420316f144dccfc98f1dd4c7d36f06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11340 Malicious code in node-fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fc78fcfb574c958db27a4d94c79bd1ae87c3d5790fdcc044e47f2f97980cfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf52df7d6ae5e92551680d7529c4cdf686b19b742648e6ff80253deaa0c9919a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11296 Malicious code in ethers-io-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d93060f754bea6c9c2c5722e253ef9599335702d72a39effe29b2b7668937dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth.json (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83a74d7ffe1be2c23f1dc0a21529f6785e63c80990839f2d44aeaa4f514bef37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in api-gateway-lambda-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a257fe33bb475cd07d71ded069ceec397276bdd4eecbf78b50d81bde8da769e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11331 Malicious code in merg-descripters (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f76e5609bceac9f395143e5329a0187c6ba35512bf453587bc2fe114622508b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11365 Malicious code in react-ag-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97513e8d4f7818787a09bd36b9c59997b9c98aeb4d731662c4092cb37fe9d687 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...