Malicious Package

Overview @noxzacode/eslint-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-71123

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-65017: Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

PT-2026-71116

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

PT-2026-71369

Name of the Vulnerable Software and Affected Versions NortheBridge/luminalshine versions prior to 26.05.0-rc4 Description An incorrect permission assignment for a critical resource exists where the file C:ProgramDataLuminalShineconfigapps.json is created by the SYSTEM service. While default Windo...

PT-2026-71463

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description The pgcrypto module allows cleartext storage when disable...

MAL-2026-13933 Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

CVE-2026-71468 Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-18703

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

CVE-2026-48771

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-48771 ishankportfolio: Stored Contact Form Submission Exposure via Public Client-Side Database Configuration

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

GHSA-W36C-QXRQ-V7FW Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references. Original Description Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code...

Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-265m-7826-wjqm. This link is maintained to preserve external references. Original Description Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778

Summary: CVE-2026-72778 affects Craft CMS 4.x (from 4.0.0-RC1 up to 4.18.2) and 5.x (from 5.0.0-RC1 up to 5.10.6). The vulnerability is an authenticated remote code execution in the control panel element-search condition handling. The root cause is that Condition::createCondition() decodes and me...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

...

CVE-2026-66774 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on...