Information Exposure

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Information Exposure in the Repo.createremote process when attacker-controlled URLs are passed and environment variables are expanded into the URL. An attacker can...

trufflehog v3.96.0

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

MAL-2026-11052 Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...

Malicious code in app-data-lts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f9d67601ec8b46265e1f23f5e48ff5beb050626f4bc156b291cb1b8f8c36d35 package.json declares postinstall node test.js and main: index.js, but index.js is absent from the tarball. test.js executes require'.', which throws...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

CVE-2026-54422

A flaw was found in OpenStack ironic-python-agent's bootc container deployment support. During bootc image deployment, the OCI registry pull secret was exposed to tenant-controlled container code running with host PID namespace visibility. A malicious bootc container image could read the operator...

CVE-2026-16802

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected...

EUVD-2026-48609

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected...

CVE-2026-17048

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-17048

The CVE-2026-17048 affects Keycloak’s Admin REST API handling of rotated client secrets stored in a secure vault. The root cause is improper boundary enforcement, allowing a delegated administrator with view-only permissions to retrieve the actual resolved secret instead of the vault placeholder,...

EUVD-2026-48587

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-17048

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-17048

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

Code Injection

LiteLLM is vulnerable to Code Injection. The vulnerability is due to insufficient sandboxing and validation of custom Python code submitted through the Custom Code Guardrails create and update paths, which allows a privileged attacker with guardrail management access to execute arbitrary Python...

CVE-2026-12654

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

Exploit for Path Traversal in Jenkins

CVE-2024-23897 — Jenkins CLI Arbitrary File Read Vulnerability...

dredge-cargo v0.10.3

This is NOT a password manager. NOT a notes app. And definetely NOT a deep-sea benthic abberant specimen taxonomic provenance registry. But it does the first two better than either. Just kidding not really. Install • Quick Start • Features • The Link Command • Commands • How It Works • Security •...