CVE-2026-76377 Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in the user...

CVE-2026-59992

Authenticated CMS editors can pass arbitrary object keys to PutObject/DeleteObject calls across four media adapters (S3, DOS, Azure, Cloudinary), bypassing mediaRoot boundaries. Fix: upgrade to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, or next-tinacms-cloudinary ...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2020-37267

A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. An attacker with access to these logs could obtain the bot's...

CVE-2026-50173

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

EUVD-2026-62589

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-50173

In Flow-Like before 1.0.4, the GET /api/v1/apps/{app_id}/invoke/presign route mints an Azure SAS token with sp=rwdl for any user holding only ExecuteEvents, even when they lack ReadFiles/WriteFiles. This lets low-privilege authenticated users directly write or delete blobs under the app content p...

CVE-2020-37267

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

EUVD-2020-31261

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

CVE-2020-37267

Renovate versions >=19.180.0 and

CVE-2020-37267 Renovate 19.180.0 before 23.25.1 Token Leakage via Logs

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

ANT-2026-XJKJSANG · supabase/auth · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-XJKJSANG: Azure issuer check uses always-true boolean expression In the Azure external auth provider azure.go:72, t...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, volsync, crossplane-provider-aws-datapipeline, kube-metrics-adapter, node-feature-discovery-fips, rancher-fleet, crossplane-provider-aws-swf-fips, bazelisk, k8s-driver-manager, thanos-operator, gostatsd, athenz-csi-driver-fips, cosign-fips,...

GO-2025-3521 vulnerabilities

Vulnerabilities for packages: harvester, longhorn-share-manager, longhorn-manager, harvester-fips, longhorn-manager-fips, rke2-runtime-fips, spark-operator-fips, vcluster, longhorn-share-manager-fips, azure-container-networking, kubernetes, argo-cd-fips...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecr, datadog-agent-fips, crossplane-provider-aws-sns-fips, crossplane-provider-aws-iam-fips, grafana-alloy, crossplane-provider-aws-kinesis, crossplane-provider-azure-sql, crossplane-provider-aws-wafv2-fips, crossplane-provider-aws-iam,...

GO-2026-5052 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, crossplane-provider-azure-storage, gobuster, telegraf, crossplane-provider-azure-managedidentity, grafana, x509-certificate-exporter, cert-manager, crossplane-provider-family-azure, goreleaser, splunk-otel-collector,...

GO-2026-5224 vulnerabilities

Vulnerabilities for packages: rancher, rancher-agent, azure-service-operator...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: buildah, containerd, datadog-agent, calico, kuma, flannel, k3s, azure-ipam, buildkitd, docker, nerdctl, istio, podman, rootlesskit, multus-cni...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: timestamp-authority, fulcio, opentelemetry-collector-contrib, boring-registry, grafana-agent-operator, falcoctl, airflow, argo-events, buildkitd, up, trivy, harbor-registry, restic, velero, step, rekor, bank-vaults, rclone, step-ca, rook, zarf, thanos, tekton-chains,...