PT-2026-23064

Name of the Vulnerable Software and Affected Versions Vaultwarden versions 1.34.3 and prior Description Vaultwarden, a Bitwarden compatible server, is susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this...

CVE-2026-2590

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by...

CVE-2026-2590

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by...

CVE-2026-2590

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by...

CVE-2026-2590

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by...

PT-2026-22827

Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager versions 2025.3.30 and earlier Description An issue exists in the connection entry component of the software where the 'Disable password saving in vaults' setting is not properly enforced. This allows an...

Devolutions Remote Desktop Manager 安全漏洞

Devolutions Remote Desktop Manager is an application system developed by the Canadian company Devolutions. It provides remote desktop management capabilities. The Devolutions Remote Desktop Manager versions prior to 2025.3.30 contained a security vulnerability. This vulnerability stemmed from...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: kyverno-fips, cg, trivy, zot, argo-events-fips, hydra-fips, flux-kustomize-controller, crossplane-provider-azure-managedidentity, docker, omnictl-multiarch-fips, gitlab-operator, crossplane-provider-aws-dynamodb, kyverno-notation-aws-fips, scorecard,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: kyverno-fips, cg, trivy, zot, argo-events-fips, hydra-fips, flux-kustomize-controller, crossplane-provider-azure-managedidentity, docker, omnictl-multiarch-fips, gitlab-operator, crossplane-provider-aws-dynamodb, kyverno-notation-aws-fips, scorecard,...

On the Security of Password Managers

Good article on password managers that secretly have a backdoor. New research shows that these claims aren’t true in all cases, particularly when account recovery is in place or password managers are set to share vaults or organize users into groups. The researchers reverse-engineered or closely...

Researchers Demonstrate 27 Attacks Against Major Password Managers

Researchers demonstrate multiple attacks against major password managers, showing how compromised servers and design flaws can expose encrypted vault data...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: kyverno-fips, cg, temporal-server, trillian-fips, hydra-fips, seaweedfs-fips, beats, agentbeat-fips, flux-kustomize-controller, caddy-fips, step-kms-plugin, prometheus-mysqld-exporter-fips, crossplane-provider-sql, sops, spicedb, rekor-fips, step, croc, step-fips,...

GO-2026-4434 EVE Seals Vault Key With SHA1 PCRs in github.com/lf-edge/eve

EVE Seals Vault Key With SHA1 PCRs in github.com/lf-edge/eve...

GO-2026-4436 EVE Has Partially Predetermined Vault Key in github.com/lf-edge/eve

EVE Has Partially Predetermined Vault Key in github.com/lf-edge/eve...

Study Uncovers 25 Password Recovery Attacks in Major Cloud Password Managers

A new study has found that multiple cloud-based password managers, including Bitwarden, Dashlane, and LastPass, are susceptible to password recovery attacks under certain conditions. "The attacks range in severity from integrity violations to the complete compromise of all vaults in an...

Malicious Package

Overview @hashicorp-internal/vault-reporting is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

MAL-2026-791 Malicious code in @hashicorp-internal/vault-reporting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85e2c508de22734977cac24ec430b5cfece85e6367f577df76caa740b5594eb7 The package @hashicorp-internal/vault-reporting was found to contain malicious code. Source: ghsa-malware...

Malicious code in @hashicorp-internal/vault-reporting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85e2c508de22734977cac24ec430b5cfece85e6367f577df76caa740b5594eb7 The package @hashicorp-internal/vault-reporting was found to contain malicious code. Source: ghsa-malware...

GHSA-G7VP-J25F-H34P EVE Has Partially Predetermined Vault Key

Impact The deriveVaultKey function calls retrieveCloudKey which always returns "foobarfoobarfoobarfoobarfoobarfo". When merged with the randomly generated 32-byte key using mergeKeys 16 bytes from each, the last 16 bytes are always "arfoobarfoobarfo". This enables an attacker with physical access...

EVE Has Partially Predetermined Vault Key

Impact The deriveVaultKey function calls retrieveCloudKey which always returns "foobarfoobarfoobarfoobarfoobarfo". When merged with the randomly generated 32-byte key using mergeKeys 16 bytes from each, the last 16 bytes are always "arfoobarfoobarfo". This enables an attacker with physical access...