12912 matches found
CVE-2026-108728
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...
CVE-2026-108728 Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...
CVE-2026-108728 Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...
CVE-2026-108728
Flyte versions 2.0.1 through 2.0.51 are vulnerable to a cleartext secret exposure vulnerability within the embedded secret manager webhook . The root cause is that the webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable . This allows users with Pod read ...
EUVD-2026-96894
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...
Authorization Bypass Through User-Controlled Key
Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the addnewmodel and canusermaketeammodelcall functions in modelmanagementendpoints.py, which authorize the caller by rol...
CVE-2026-12980 Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed...
CVE-2026-12980
The Post Snippets WordPress plugin, affecting versions through 4.2.4 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape variable values substituted into snippets before they are outputted to the page. This flaw allows users with Contributor rol...
CVE-2026-12980 Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed...
PT-2026-110131
Name of the Vulnerable Software and Affected Versions Flyte versions 2.0.1 through 2.0.51 Description An issue exists where secrets are stored in cleartext, allowing users with Pod read access to obtain sensitive information by reading init container environment variables. The embedded secret...
mini-swe-agent 2.4.6 Environment Variable Exposure
mini-swe-agent versions 1.10.0 through 2.4.6 contain an environment variable exposure in BubblewrapEnvironment. The included proof of concept checks whether a harmless host environment marker is inherited by a sandboxed command...
CVE-2026-108728: Cleartext Storage of Sensitive Information
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment...
Exploit for CVE-2026-108592
CVE-2026-108592 — Environment Variable Exposure PoC A proof o...
CVE-2026-24061-GNU-InetUtils-telnetd
CVE-2026–24061 : GNU InetUtils telnetd Authentication Bypass Vulnerability CVE-2026–24061 is a critical weakness in the telnetd service of GNU InetUtils CVE ID : CVE-2026–24061 Severity : Critical CVSS 9.8 Attack Vector : Network Authentication Required : None Impact : Full system compromise root...
CVE-2026-108547
The AstronRPA software (versions through 1.1.6 ) is vulnerable to a cross-tenant shared variable disclosure due to a missing tenant authorization check in the robot-service component. Specifically, authenticated users can access the get-batch-shared-var endpoint to read shared variables belonging...
CVE-2026-108547 AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...
CLEANSTART-2026-CG47796 Apache Airflow's secrets masker did not mask `var
Security vulnerability affects the airflow-3 package. Apache Airflow's secrets masker did not mask var...
CLEANSTART-2026-ZG38480 Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope
Security vulnerability affects the airflow-3 package. Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope...
PT-2026-117925
Security vulnerability affects the airflow-3 package. Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope...