40789 matches found
CVE-2026-8715
CVE-2026-8715 – Vault Secrets Operator : Affected versions are 1.3.0–1.4.1 of Vault Secrets Operator. The issue is an arbitrary file read/credential exfiltration in the AppRole authentication configuration that could allow a tenant with limited Kubernetes RBAC to read files from the operator pod ...
CVE-2026-8715 Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...
Vault Secrets Operator vulnerable to arbitrary file read via AppRole secretIDPath
Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod’s filesystem and transmit the...
MAL-2026-14002 Malicious code in index-design-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46741db74596587c4d689ad282865566173c18913e95bacac258d20ac71da8cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in keyed-mutex-map (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45a0cb60ef881a4f011fed410aacced4d83f39457bea6c4f21fa7d09076801 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in resource-lease-pool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731d4ed32c1947117f9e7243c0179f5076213414505bf38176e660653df025f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14011 Malicious code in shared-slot-gate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 567d0e00a8f67763d2490a1c3bcd2e806e5c02eed7b87c5ba7c082d779d7243e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in ts-enum-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f362b9a6fbb2e117301be8a8195f14b6fa8481e3dcc3b37faff3d6eb111b0070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix...
MAL-2026-13996 Malicious code in @nolimit-agent/linux-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a61df0713e6ffb3921a4819c4c80540bfd596d8b71e4f2015f3ed580c9f804d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-73604
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
CLEANSTART-2026-AP22557 Security fixes in external-secrets-fips 2.7.0-r1
Package external-secrets-fips version 2.7.0-r1 fixes 5 vulnerabilities: CVE-2026-2303, ghsa-cp6g-7hqx-qxhp, ghsa-hrxh-6v49-42gf, ghsa-gcjh-h69q-9w9g, ghsa-mpwr-8vm7-h73f...
CLEANSTART-2026-OT46541 Security fixes in secrets-store-csi-driver-fips 1.6.0-r1
Package secrets-store-csi-driver-fips version 1.6.0-r1 fixes 5 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-41178, CVE-2026-42505, CVE-2026-39822...
CVE-2026-73604
Flowise (pre-3.1.3) has an incomplete credential redaction vulnerability in GET /api/v1/credentials/:id that exposes decrypted secrets to authenticated users with credentials:view. Impact described includes database connection URLs with passwords, cloud service account JSON with private keys, and...
EUVD-2026-57808
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...
Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.1.1
external secrets operator for Red Hat OpenShift 1.1.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...
EUVD-2026-57688
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client po...
