CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

EUVD-2026-77640

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-57128

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

CVE-2026-57128

PraisonAI (praisonaiagents

CVE-2026-57128 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

CVE-2026-57128 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

EUVD-2026-77533

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

CVE-2026-84179

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

CVE-2026-84179 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

CVE-2026-84179 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

EUVD-2026-77455

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files duri...

CVE-2026-90937 froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files duri...

CVE-2026-90937

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs . An authenticated customer can supply URLs containing literal newlines that are written verbatim into vhost configuration files during the cron rebuild process, enabling injection of arbitrary nginx or A...

CVE-2026-90919

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: A buffer overflow has been fixed in the configuration retrieval process. The scarlett2usbgetconfig function contains a logical error in the endianness conversion code, which can lead to buffer overflows when coun...

Astra Linux – Vulnerability in ffmpeg

A denial-of-service vulnerability exists in FFmpeg 4.2 due to a memory leak in the configinput function in the afacrossover.c file...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: A reference count leak was fixed in hshewephaslimitsbox. pcigetdevice will increase the reference count of the returned ‘dev’. We need to call pcidevput to decrease the reference count. Since ‘dev’ is only...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tty: A possible resource leak was fixed in icomprobe. When pcireadconfigdword failed, calls to pcireleaseregions and pcidisabledevice were made to reallocate the previously allocated resources...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted using a single master key provided by the user. There was a flaw in LibreOffice where the master key was poorly encoded, resulting in a reduction in its entro...