CVE-2026-48786

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

Malicious code in self-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b684f78f17626dead6b3d11131179a7a1aff7fa5e903daeecdac17ce8e3b99b3 The exported generate function in [email protected] accepts an undocumented third defaults parameter. When passed a string, the code strips PEM...

Malicious code in self-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced9167241d391937ba7b1f2625aa3f8184d832ebc61c182936100ae3a3f13bd Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, once the PEM headers are...

CVE-2026-46371

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

EUVD-2026-66671

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46370

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

EUVD-2026-66667

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2026-48786

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

EUVD-2026-66657

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

MAL-2026-14541 Malicious code in svelte-vli-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e69d1c24676b4273c3413856b424256c6ff7a437a48e7037156fa5f7f8911060 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14540 Malicious code in @lordmega/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 373164cdb5f1cd37cf187a23142c1bc64c0a350c38ce6ca0fe7f5884269a0317 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in array-shuffler-utils-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 233594ba444a80cbd5c49ac1da879d813b4ca97677dbe05930931496cd29582c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14521 Malicious code in fivem-tool-helper-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b33a1f643603b3bbf0f4e15b104240715e0de6a10025eeeafb9b015d684ca5f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

titus v1.2.8

Titus: High-Performance Secrets Scanner Titus is a high-performance secrets scanner that detects credentials, API keys, and tokens in source code, files, and git history. It ships with 487 detection rules covering hundreds of services and credential types, drawn from NoseyParker and Kingfisher...

CVE-2026-48786: Exposure of Sensitive Information to an Unauthorized Actor

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-46371: Improper Neutralization of Special Elements used in an SQL Command

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46370: Improper Neutralization of Special Elements used in an SQL Command

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

Malicious code in svelte-ui-cls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41593a52d2887b1bbbf1e1982cd8a12d011dfd8802605e083fdbfc86bf7ab5a8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...