Spring Cloud Config Server Logged Sensitive Information

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs...

Insertion of Sensitive Information into Log File

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File through the AwsCodeCommitCredentialProvider class in...

Empty Password in Configuration File

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Empty Password in Configuration File through the GoogleSecretManagerV1AccessStrategy in the...

Directory Traversal

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Directory Traversal via the EnvironmentController, ResourceController, and EncryptionController reque...

Spring Cloud Config Clients Can Access Secrets From Any Project The Config Server Has Access To On Google Secrets Manager

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +38 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-41002 Source advisory:...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +38 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-40982 Source advisory:...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +38 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-40981 Source advisory:...

PT-2026-38286

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.17.11 Craft CMS versions 5.0.0 through 5.9.17 Description An input-handling flaw in a Yii object creation path allows authenticated users to inject malicious configuration and execute arbitrary commands on th...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +3 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-40981 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-16439020...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +3 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-41002 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-16439108...

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file...

PT-2026-38295

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.49 Description The set value function in GitConfigParser passes values to Python's configparser without validating for newlines. Although the write function converts embedded newlines into indented continuation...

RHCOS 4 : OpenShift Container Platform 4.4.13 machine-config-daemon and openshift (RHSA-2020:2927)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2927 advisory. - kubernetes: node localhost services reachable via martian packets CVE-2020-8558 - proglottis/gpgme: Use-after-free in GPGME bindin...

RHCOS 4 : OpenShift Container Platform 4.7.13 (RHSA-2021:2122)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2122 advisory. - golang: data race in certain net/http servers including ReverseProxy can lead to DoS CVE-2020-15586 - golang: ReadUvarint and...

RHCOS 3 : OpenShift Container Platform 3.11.462 (RHSA-2021:2517)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2517 advisory. - jetty: local temporary directory hijacking vulnerability CVE-2020-27216 - jetty: buffer not correctly recycled in Gzip Request...

RHCOS 4 : OpenShift Container Platform 4.5.41 (RHSA-2021:2431)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2431 advisory. - jetty: local temporary directory hijacking vulnerability CVE-2020-27216 - jetty: buffer not correctly recycled in Gzip Request...

Linux Distros Unpatched Vulnerability : CVE-2026-42151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write...

Linux Distros Unpatched Vulnerability : CVE-2026-43274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchpipcgetclusteraggrirq The clustercfg array is dynamically allocated to hold per-CPU configuration...

Grav is Vulnerable to Stored XSS via Tag Injection

Summary A low-privileged with the ability to create a page user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the...