@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

CVE-2026-90451 Use of Default Credentials in Malcolm

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

CVE-2026-90451

CVE-2026-90451, assigned by CISA ICS-CERT , describes a vulnerability in a bundled packet-analysis component where a fixed, publicly-known secret value is shipped in an example environment-configuration file. This secret is used to sign authentication cookies for that component. Deployments that ...

CVE-2026-90451 Use of Default Credentials in Malcolm

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

CVE-2026-90451 Use of Default Credentials in Malcolm

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

EUVD-2026-38207

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover...

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

CVE-2026-72708

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

CVE-2026-89298

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-89298

A flaw in Keycloak 's Dynamic Client Registration service allows a user with the view-clients role to retrieve a client's confidential secret in cleartext via the client registration GET endpoint. The root cause is a failure to mask sensitive information when returning client details. A read-only...

CVE-2026-89298 Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-89298 Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

EUVD-2026-76104

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-89298

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

BIT-TOMCAT-2026-43514 Apache Tomcat: AJP secret compared in non-constant time

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may al...

CVE-2026-89060

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

EUVD-2026-75948

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

CVE-2026-89060 Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

CVE-2026-89060 Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

CVE-2026-89060

Stolostron multicluster-observability-addon is affected by a cross-namespace secret disclosure flaw. A managed-cluster identity can reference configuration resources outside its designated namespace, allowing an attacker-controlled managed cluster to access sensitive hub Secrets . The CVSS 3.1 sc...