CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

EUVD-2026-67813

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282

Atlantis (through version 0.47.1 ) contains an authentication bypass in the /github-app/setup endpoint. The endpoint fails to require authentication, allowing unauthenticated callers to observe or intercept the GitHub redirect during app setup and extract the RSA private key and webhook secret . ...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82240

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82240

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

EUVD-2026-67692

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

Root-My-Galaxy-Payloads-Testing

Root My Galaxy Payloads This repository contains the device-s...

The vulnerability of the App Package Installer installation program for Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the App Package Installer installation program for Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the App Package Installer installation program for Windows operating systems allows a perpetrator to increase their privileges.

The vulnerability of the App Package Installer installation program for Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2026-83305

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282: Missing Authentication for Critical Function

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

PT-2026-82870

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...

Malicious code in @hd-team/app-dnpkg-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529 The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a...