CVE-2026-50152 Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...

Malicious code in stackpaths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a27ce2899b65f55deaab5feaf1b3cfd2ae674a45fd3e87ab442c58d3d89ba79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in r4wk-book (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5cbca68751eb879140f7c896a0dc3c324e9f4dbc8a1651b38b246b299ba4eb On npm install, the package's postinstall hook runs node.worker.js, which detaches a background child, waits a jittered delay, and opens a TCP socket...

MAL-2026-14504 Malicious code in video-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdb2c9b6369a68d75f6e0df274da90f2685d5735f944992516f13c3e9f60b0b9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

BIT-KEYCLOAK-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

Malicious code in classroomlesson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cee9290a110b32c6fab4129e634205ed0b86080ccf328dfe5e17635bc85b7926 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dext-crate-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e581bed6c9028ebf84b341f914135c1af62bc9b75072f1c511c4c187cb94abfd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-55622

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-55622 Incus has a project restriction bypass in instance copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

MAL-2026-14122 Malicious code in ulebkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9 index.js unconditionally requires./perf.js on load. perf.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, /.aws/credentials, /.aws/config, and...

BIT-AIRFLOW-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2025-59325

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details...

Malicious code in mnmobicom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 551bd821f3078161e164c495a903b00133be4ef630a3c70e6472a8235df93a3b Package [email protected] was scanned with 2 files and no static or behavioral findings were produced. No lifecycle scripts, no network exfiltration, n...

CVE-2025-59325

CPSD CryptoPro Secure Disk for BitLocker versions before 7.7.4 fails to encrypt initramfs contents, allowing attackers with physical access to recover secrets and cryptographic keys offline. CVSS 7.5 (HIGH) reflects high confidentiality impact with low complexity. No public exploit code is provid...

CVE-2025-59325

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details...

CVE-2025-59325

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details...

EUVD-2025-210718

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details...

CVE-2026-19429

Jenkins FilePath.untarFrom does not validate symlink targets when extracting TAR archives, allowing an attacker with Item/Configure permission to create symlinks from a workspace to arbitrary files on the Jenkins controller. This issue remains exploitable in versions patched for CVE-2026-33001 an...