CVE-2026-75033

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

CVE-2026-75033 Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

CVE-2026-75033

CVE-2026-75033 is a cross-cluster secret leakage vulnerability in Rancher Manager (before 2.15.1 ). Project Secrets were propagated into a namespace based solely on the field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. An ...

CVE-2026-75033 Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

CVE-2026-75033 Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

CVE-2026-3416

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

EUVD-2026-70453

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

CVE-2026-3416

WSO2 products' API Publisher component used a non-cryptographic pseudorandom number generator (PRNG) to generate shared secrets for Webhook HMAC validation. Because the PRNG lacks sufficient entropy, a sophisticated attacker can predict future secrets and forge event payloads with valid HMAC sign...

CVE-2026-3416 Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

CVE-2026-3416 Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver: OpenTelemetry Collector Contrib githubreceiver: Unauthorized data injection via authentication bypass

A flaw was found in the OpenTelemetry Collector Contrib's githubreceiver component. An unauthenticated attacker can bypass authentication mechanisms, including required headers and HMAC validation, when the 'Secret' field is empty. This allows the attacker to submit arbitrary webhook payloads,...

CVE-2026-85171 n8n before 1.123.73 Credential Exposure via Error Logging

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...

CVE-2026-85171

n8n versions before 1.123.73 , 2.35.4 , and 2.36.2 are affected by a credential exposure vulnerability in the Strapi , SeaTable , and Mailcheck nodes. The root cause is that these nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any erro...

EUVD-2026-70406

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...

Malicious code in btree-leaderboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ceaaf14d642f02835e10e1eb7de05ea911ecf2b72bc354305aa3d6bf874e4e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in neighbor-key-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d780b9dd8236dfbb127579a5d58fac8423ea3992ce4900bf41abce906aae39 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15890 Malicious code in ordered-freq-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508695a38291fb41f6ca49b06070cf670e079fd43796e1812acabdd467ba9166 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sliding-score-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e2a97d5dd3e10080ee69201bf757ea14ebda90b9da1be41392584152ad1f1d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15891 Malicious code in ordered-kv-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55d622b138793a2b659f171c3420c5c66df969939d4e3be8c7d4099e4f4fd48f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15874 Malicious code in btree-leaderboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ceaaf14d642f02835e10e1eb7de05ea911ecf2b72bc354305aa3d6bf874e4e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...