CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

JLSEC-2026-811 A malicious EXR file can trigger undefined behavior in OpenEXR

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger decodes a variable-length integer fro...

PT-2026-65894

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check. This allows a workflow parameter to bypass the default...

PT-2026-76533

On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with split ascii whitespace. If an application passes an attacker-controlled non-HTTPS URL whose parsed form retains...

CVE-2026-67427: Insufficiently Protected Credentials

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

envocabulary v1.0.3

envocabulary For every variable in your current shell, find the file and line that set it — or which subsystem direnv, launchd, terminal, SSH, system injected it. Plus a few static-file commands for the moment your shell config has sprawled across N files and backups and you've lost the plot. I...

SUSE CVE-2026-17574

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

DedeCMS 5.8.1-beta - Remote Code Execution Detection

DedeCMS 5.8.1-beta is susceptible to remote code execution via a variable override vulnerability that allows an attacker to construct malicious code with template file inclusion without proper authorization, thus possibly obtaining sensitive information, modifying data, and/or gaining full contro...

Juniper J-Web - Remote Code Execution Detection

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands !/usr/bin/env python3 -- coding: utf-8 -- """A PHP External...

Kentico CMS 8.2 - Open Redirect Detection

Kentico CMS 8.2 contains an open redirect vulnerability via GetDocLink.ashx with link variable. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico CMS 8.""" import re from kittysplo...

Benchmarking Optical Receivers for Quantum Communication and Randomness Certification

The choice of optical receiver determines which properties of the transmitted states remain visible in the observed data and therefore affects the performance of different quantum protocols. We compare continuous-variable, photon-counting and hybrid receivers within the same prepare-and-measure...

Malicious code in lokal-mcp (npm)

Source: amazon-inspector 04df34ff182a72a46dc032016ed38e0caf7452ac3b8d382bb15221706c01a9e8 index.js contains a hardcoded URL https://rettfrabonden.com referenced alongside process.env reads and fetch POST calls index.js line 24 defines the destination, lines 29 and 37-38 perform fetch/POST. The...

Malicious code in @inetafrica/open-claudia (npm)

Source: amazon-inspector 09b3881ec598069649e57612f04359886ef22331899541885248ea6a0a41bce2 Multiple files in this package contain a Telegram-bot-based command-and-control and exfiltration framework wired to install/runtime-reachable code paths. setup.js line 57, 73 and health.js line 90 embed...

Malicious code in @cloudplatform-single-spa/svp-draas (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in @cloudplatform-single-spa/dns (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

DEBIAN-CVE-2026-17574

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

AZL-94019 CVE-2026-17574 affecting package hdf5 for versions less than 1.14.6-4

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

CVE-2026-17574

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...