CVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

CVE-2026-66018

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

CVE-2026-66018 JFrog Artifactory build environment properties exposure

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

CVE-2026-66018 JFrog Artifactory build environment properties exposure

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

CVE-2026-66018

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

EUVD-2026-49573

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

CVE-2026-66018

CVE-2026-66018 affects JFrog Artifactory: Build readers can access another repository's environment properties by selecting a readable repository parameter when retrieving environment properties for a protected build, exposing build environment secrets. Impact is confidentiality only (no integrit...

CVE-2026-17570

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...

Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 832cecce176cee15be4875642bd875636a40159560e29bd359746b2c80359e10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b53f3137f847d7234a065286565e0112a828bb14dd580d6ea46a9c262397294 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in crm-reportinsightserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf3e452fd66c689c6ac38c2bc8b7db35db15202a7b921659ca48c8ed352381c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stargateproxyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30672bc5027216bfe87a3a8c7687d7fbd70194afcd47f548712390b1289d3241 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in identityauthorizationserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef1d43e872519f6b1865d149c6f202e9079165bc28c12645e8154155d61e7455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11099 Malicious code in demo-awesome-date-parser-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dac7edbd7a941a69901501e2f602b37a483dde93aac9af9270f146fea0e7992 The package advertises itself as a date parser but the public API demoParseDate performs several unrelated hostile actions against the calling...

Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 493d92c75a6ab0daa328300c9f6a6b177a8a4fd656b8f0431f60e11f1ef3e060 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-motionkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44ccc8950e5ba2f4445eb663dafe54d1abf35fc0af58cb14d449fa66ccb26a38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-OPENBAO-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

BIT-OPENBAO-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...

BIT-OPENBAO-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

CVE-2021-32086

CVE-2021-32086 affects Quest KACE Systems Deployment Appliance (SMA) 11.0.273. The issue is a hardcoded symmetric encryption key used to encrypt secrets in MySQL databases, with the key not unique per installation. If an attacker gains access to the MySQL server or backup files, they can decrypt ...