CVE-2026-22822

CVE-2026-22822 affects the External Secrets Operator. The root issue is the getSecretKey templating function, which in versions starting from 0.20.2 and prior to 1.2.0 allowed cross‑namespace retrieval of secrets via the controller’s roleBinding, bypassing safeguards. This could lead to unauthori...

CVE-2025-14377

A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a playbook is running. This component has been retired and has been optional since the 1.36 release in 2024...

CVE-2025-14376

A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This component has been retired and has been optional since the 1.36 release in 2024...

BIT-AIRFLOW-2025-68438 Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed core maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...

MAL-2026-439 Malicious code in tv-admin-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23c0b8199883c9cf5ea055f98b5f90f8cfb349eceba1b6c4026ef3b94c96872b The package tv-admin-commons was found to contain malicious code. Source: ghsa-malware 0b766afca3bfb069abd800cf6cb59759fc8555cdeb01e8d8e0576d5adaf720...

Malicious code in tv-admin-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23c0b8199883c9cf5ea055f98b5f90f8cfb349eceba1b6c4026ef3b94c96872b The package tv-admin-commons was found to contain malicious code. Source: ghsa-malware 0b766afca3bfb069abd800cf6cb59759fc8555cdeb01e8d8e0576d5adaf720...

Malicious code in ts-tweetnacl-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8035e1fe9ea296c85e726e0afad93eacff3199c25542e19153f914cc63251c12 The package ts-tweetnacl-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-438 Malicious code in ts-tweetnacl-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8035e1fe9ea296c85e726e0afad93eacff3199c25542e19153f914cc63251c12 The package ts-tweetnacl-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-437 Malicious code in lumo-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5d24591ceb311425ae395bd2b1bf7f82818bd6c7946d669a19c619462fd755 The package lumo-api-client was found to contain malicious code. Source: ghsa-malware da916419989a0707bcaa3fc59ba24e3ef90e2ec5df35aa6cc1e81f8d3cb82c6...

Malicious code in jquery-ajaxchimp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a460673be9b990e588584788a155a2341ce31fabf8d07d3d0e1b9dda16bb299 The package jquery-ajaxchimp was found to contain malicious code. Source: ghsa-malware 4075366a7f1f1cb9f88b4b4c300e0e79757fea87b01c85fbab708f9be098cf...

MAL-2026-436 Malicious code in jquery-ajaxchimp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a460673be9b990e588584788a155a2341ce31fabf8d07d3d0e1b9dda16bb299 The package jquery-ajaxchimp was found to contain malicious code. Source: ghsa-malware 4075366a7f1f1cb9f88b4b4c300e0e79757fea87b01c85fbab708f9be098cf...

Malicious code in aligntype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00d265590e58665b4942474738b7d5beca8f636eb79e8761f736088d603f9277 The package aligntype was found to contain malicious code. Source: ghsa-malware b0d41c223d47ebc018df2b4ee07cde5c197d028c7b973a32f34bcb4e19e9a7fd Any...

MAL-2026-435 Malicious code in aligntype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00d265590e58665b4942474738b7d5beca8f636eb79e8761f736088d603f9277 The package aligntype was found to contain malicious code. Source: ghsa-malware b0d41c223d47ebc018df2b4ee07cde5c197d028c7b973a32f34bcb4e19e9a7fd Any...

MAL-2026-409 Malicious code in chai-async-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d513c8edc24de9b9993282b15030364ac655c161954965840f5a8d630470cef1 The package chai-async-test was found to contain malicious code. Source: ghsa-malware 44653d8509702f49ad07480d256afe34186fa1f3920fca7b95d57ef1f7ed855...

Malicious code in chai-async-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d513c8edc24de9b9993282b15030364ac655c161954965840f5a8d630470cef1 The package chai-async-test was found to contain malicious code. Source: ghsa-malware 44653d8509702f49ad07480d256afe34186fa1f3920fca7b95d57ef1f7ed855...

MAL-2026-415 Malicious code in dotenv-expanded (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e36cd005779e12b645b7ec5f6e65df1edae7c6d86736507cd1feacec1ef7cf The package dotenv-expanded was found to contain malicious code. Source: ghsa-malware 8c545865cdbec4a05b0f51103dd3560d60c3f43b818465e4a935a47bf84078d...

Malicious code in dotenv-expanded (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e36cd005779e12b645b7ec5f6e65df1edae7c6d86736507cd1feacec1ef7cf The package dotenv-expanded was found to contain malicious code. Source: ghsa-malware 8c545865cdbec4a05b0f51103dd3560d60c3f43b818465e4a935a47bf84078d...

Malicious code in weaviate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229f83d7066881287b7035e8e71dc5ed74531480ab19cbf47ebd72990bc1525 The package weaviate-js was found to contain malicious code. Source: ghsa-malware bb063c82675f5933564b46d7e49a2c2a7aac395d9a399b1264e3de0aafb29905 An...

Malicious code in qdrant-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad84f3d1657583a0a6fa9d58b06258298369ea5e4ee10ac0516c3f641b33871 The package qdrant-js was found to contain malicious code. Source: ghsa-malware 789e158c461e8c11f86da5b04f09dab1797536199084bf548efc2f3ee13b33f1 Any...

Malicious code in replicate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84c6cb090eb31f1b2c516b45419d7833bca83f5546d22444032d28a07d27f40 The package replicate-js was found to contain malicious code. Source: ghsa-malware 658bf1d6aa22bb672e5ae9724e34b94ee7ff73e7cd4381ff4a6a8c9c2d1267fa A...