CVE-2026-82641

Keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all network interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. An unauthenticated attacker on the network can retrieve NSS keylog lines via /agent/pcap/keylog and dec...

CVE-2026-66016

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...