CVE-2026-78627

Okta Hyperdrive Integration installer exposes the OAuth client secret in plaintext when it is passed as an MSI property. The credential is recorded in three locations readable by an authenticated local user: the installer log , the Application Event Log , and the process command line . The CVSS 3...

CVE-2026-79575

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...

CVE-2026-73309

XenForo before 2.3.13 is vulnerable to an authentication bypass in its OAuth2 token endpoint . An unauthenticated attacker can submit empty strings for the client_secret and code_verifier parameters; because PHP truthy evaluation treats empty strings as falsy, both the client secret check and the...

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-80219

CVE-2026-80219 was rejected by Red Hat Product Security as "not needed," yet the underlying flaw is well documented in the hawtio-operator for OpenShift. When Hawtio is deployed in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) an...

CVE-2026-77968 Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

EUVD-2026-72692

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

Exploit for CVE-2026-19949

CVE-2026-19949 — Prueba de concepto documentada y reproducible...

MAL-2026-16045 Malicious code in i18nexus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37d8dfb4ceaec110414441ebad5da37dad342ef653a20499504385d9db1ffdac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in i18nexus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37d8dfb4ceaec110414441ebad5da37dad342ef653a20499504385d9db1ffdac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @web2apk/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad4c3329ebb2fdeb3b9ddc93abcb5f3dab6773f7a7999ff96d063d49edc04d9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Important: Red Hat Security Advisory: Red Hat Multiarch Tuning 1.3.4

The 1.3.4 release of the Red Hat Multiarch Tuning Operator. For more details, see product documentation in the references section. Enhancements: With this update, MTO has been updated to use go version 1.26.7. Bug Fixes: Previously, deleting a ClusterPodPlacementConfig object immediately after...

CVE-2026-78627: Insertion of Sensitive Information into Log File

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...

CVE-2026-77968: Improper Privilege Management

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

PT-2026-87034

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-79575

The software yfexam-exam v2.0 contains a vulnerability where the JWT signing secret is derived from the username and the current month rather than using a random server-side key. This insufficient randomness allows an attacker to obtain the secret key through a bruteforce attack . No specific exp...

PT-2026-88438

Name of the Vulnerable Software and Affected Versions Okta Hyperdrive Integration affected versions not specified Description The installer fails to mask the OAuth client secret when it is passed as an MSI property. This results in the credential being recorded in plaintext within the installer...

EUVD-2026-72912

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...

PT-2026-87113

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...