vault

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

wrongsecrets

OWASP WrongSecrets !Docker container testhttps://github.com/OWASP/wrongsecrets/actions/workflow...

envsec

envsec Gestione sicura dei segreti d'ambiente utilizzando i depositi nativi del sistema operativo. Demo Funzionalità Memorizza i segreti nel deposito nativo del sistema operativo non in file di testo semplice Multipiattaforma: macOS, Linux, Windows Organizza i segreti per contesto es. myapp.dev,...

cottage

cott age is a GitOps tool for teams to manage age-encrypted secrets in git repositories. It provides a simple workflow to encrypt/decrypt secrets, manage recipients, and keep secrets out of the repo while still allowing for easy sharing via VCS. cottage also generates redacted previews of encrypt...

conjur

Conjur Manutenibilità Copertura dei test Conjur fornisce gestione dei segreti e identità delle applicazioni per l'infrastruttura moderna: Linguaggio di markup delle autorizzazioni per macchine "MAML" , un linguaggio di policy di accesso basato sui ruoli per definire i componenti di sistema e i lo...

GO-2024-2982 vulnerabilities

Vulnerabilities for packages: vault...

GO-2026-5377 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-5723 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-5426 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, crossplane-provider-aws-route53, podinfo, crossplane-provider-family-aws, thanos, vault-env, pulumi-language-yaml, grafana-alloy, cluster-api-gcp-controller, addon-resizer, azure-service-operator, migrate, k3s, rancher-webhook, keda,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: promxy, chezmoi, thanos, grafana-alloy, k3s, wal-g, fluent-bit-plugin-loki, buildkitd, gitsign, crossplane, amazon-cloudwatch-agent-operator, spire-server, opentelemetry-collector, goreleaser, terraform, eksctl, step, oauth2-proxy, op-geth, traefik, minio-operator,...

Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.1.1

external secrets operator for Red Hat OpenShift 1.1.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...

BIT-OPENBAO-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

[SECURITY] Fedora 43 Update: openbao-2.5.4-1.fc43

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 43 Update: openbao-2.5.3-1.fc43

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 44 Update: openbao-2.5.2-1.fc44

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

CVE-2026-40264

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

CVE-2026-40264

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

CVE-2026-39946

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...

CVE-2026-33758

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...

EUVD-2026-16624

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishin...