org.pac4j:pac4j-cas (4.5.10), org.pac4j:pac4j-config (4.5.10) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (4.5.10)

org.pac4j:pac4j-core MAVEN version 4.5.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 4.5.10 - org.pac4j:pac4j-config 4.5.10 - org.pac4j:pac4j-couch 4.5.10 - org.pac4j:pac4j-gae 4.5.10...

org.marid:marid-ide-server (0.9.8.6), org.pac4j:pac4j-cas (3.8.1) +12 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.8.1)

org.pac4j:pac4j-core MAVEN version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.marid:marid-ide-server 0.9.8.6 - org.pac4j:pac4j-cas 3.8.1 - org.pac4j:pac4j-config 3.8.1 - org.pac4j:pac4j-couch...

org.pac4j:dropwizard-pac4j (2.0.0-rc1), org.pac4j:j2e-pac4j (2.0.0-rc1) +15 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (2.0.0-rc1)

org.pac4j:pac4j-core MAVEN version 2.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:dropwizard-pac4j 2.0.0-rc1 - org.pac4j:j2e-pac4j 2.0.0-rc1 - org.pac4j:jax-rs-pac4j 2.0.0-rc1 -...

org.pac4j:pac4j-cas (1.9.8), org.pac4j:pac4j-config (1.9.8) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.9.8)

org.pac4j:pac4j-core MAVEN version 1.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.9.8 - org.pac4j:pac4j-config 1.9.8 - org.pac4j:pac4j-gae 1.9.8 - org.pac4j:pac4j-http 1.9.8 -...

io.buji:buji-pac4j-core (>=1.4.2, <=1.4.3), io.buji:buji-pac4j-servlet (>=1.4.2, <=1.4.3) +18 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.8.7)

org.pac4j:pac4j-core MAVEN version 1.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - io.buji:buji-pac4j-core =1.4.2, =1.4.2, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr7 - org.pac4j:pac4j-cas 1.8.7 -...

org.pac4j:pac4j-cas (3.8.0), org.pac4j:pac4j-config (3.8.0) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.8.0)

org.pac4j:pac4j-core MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 3.8.0 - org.pac4j:pac4j-config 3.8.0 - org.pac4j:pac4j-couch 3.8.0 - org.pac4j:pac4j-gae 3.8.0 -...

org.pac4j:pac4j-cas (3.6.0), org.pac4j:pac4j-config (3.6.0) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.6.0)

org.pac4j:pac4j-core MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 3.6.0 - org.pac4j:pac4j-config 3.6.0 - org.pac4j:pac4j-couch 3.6.0 - org.pac4j:pac4j-gae 3.6.0 -...

org.pac4j:pac4j-cas (1.9.3), org.pac4j:pac4j-config (1.9.3) +12 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.9.3)

org.pac4j:pac4j-core MAVEN version 1.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.9.3 - org.pac4j:pac4j-config 1.9.3 - org.pac4j:pac4j-gae 1.9.3 - org.pac4j:pac4j-http 1.9.3 -...

com.yahoo.sherlock:sherlock (>=1.11, <=1.13), org.pac4j:pac4j-cas (3.2.0) +18 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.2.0)

org.pac4j:pac4j-core MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - com.yahoo.sherlock:sherlock =1.11, =1.13 - org.pac4j:pac4j-cas 3.2.0 - org.pac4j:pac4j-config 3.2.0 -...

com.efluid.oss:efluid-datagate-app (>=1.0.0-beta-21, <=3.1.1), com.efluid.oss:efluid-datagate-app-cucumber (>=1.0.0-beta-21, <=3.1.1) +17 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.3.0)

org.pac4j:pac4j-core MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - com.efluid.oss:efluid-datagate-app =1.0.0-beta-21, =1.0.0-beta-21, =3.1.1 - org.pac4j:j2e-pac4j 4.1.0 -...

org.pac4j:pac4j-cas (1.8.3), org.pac4j:pac4j-config (1.8.3) +15 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.8.3)

org.pac4j:pac4j-core MAVEN version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.8.3 - org.pac4j:pac4j-config 1.8.3 - org.pac4j:pac4j-gae 1.8.3 - org.pac4j:pac4j-http 1.8.3 -...

Exposed Git repository detection

Detects publicly accessible Git metadata such as /.git/HEAD or /.git/config. !/usr/bin/env python3 -- coding: utf-8 -- """Detect publicly accessible Git metadata /.git/HEAD, config, index, ….""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PROBEPATHS = "/.git/HEAD"...

Malicious code in solanakit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e8770458eab636335241e359b6cee149cc00640fb2418b4462c89ec88accc93 During import, the code downloads and starts a malicious package hosted on GitHub. It then first ensures persistency e.g., through the autostart registry key...

MAL-2026-2837 Malicious code in solanakit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e8770458eab636335241e359b6cee149cc00640fb2418b4462c89ec88accc93 During import, the code downloads and starts a malicious package hosted on GitHub. It then first ensures persistency e.g., through the autostart registry key...

PT-2026-35600

Summary Memory dreaming config persistence was reachable from operator.write commands. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.5 = 2026.4.10 Impact A write-scoped gateway path could toggle persistent memory dreaming settings through /dreamin...

PT-2026-37014

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.14 Description A redaction bypass exists that allows authenticated gateway clients with config read access to receive unredacted secrets. This occurs through the sourceConfig and runtimeConfig alias fields,...

PT-2026-35616

Summary Nostr profile mutation routes allowed operator.write config persistence. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 Impact Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007497)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007497 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref due to drmmmodeconfiginit drmmmodeconfiginit will call...

[SECURITY] Fedora 44 Update: kde-gtk-config-6.6.4-1.fc44

This is a System Settings configuration module for configuring the appearance of GTK apps in KDE...

BIT-AIRFLOW-2025-66236 Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though...