Lucene search
+L

2824 matches found

EUVD
EUVD
added 3 days ago6 views

EUVD-2026-57265

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

5.4CVSS5.4AI score0.00222EPSS
SaveExploits0References3
EUVD
EUVD
added 4 days ago8 views

EUVD-2026-56898

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

6.3CVSS5.3AI score0.00205EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 4 days ago7 views

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

6.3CVSS5.3AI score0.00205EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 4 days ago8 views

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

6.3CVSS5.3AI score0.00205EPSS
SaveExploits0References3
OSV
OSV
added 4 days ago6 views

MAL-2026-13737 Malicious code in @openzeppelin-4/contracts (npm)

@openzeppelin-4/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v4 line via the look-alike scope @openzeppelin-4, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

5.4AI score
SaveExploits0References2
NVD
NVD
added 4 days ago9 views

CVE-2026-72782

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

7.1CVSS0.00227EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 4 days ago8 views

CVE-2026-72782

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

7.1CVSS5.4AI score0.00227EPSS
SaveExploits0References3
OSV
OSV
added 4 days ago6 views

CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

7.1CVSS5.5AI score
SaveExploits0References4
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

7.1CVSS0.00227EPSS
SaveExploits0References2
EUVD
EUVD
added 4 days ago7 views

EUVD-2026-56106

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

7.1CVSS5.4AI score0.00227EPSS
SaveExploits0References2
CVE
CVE
added 4 days ago29 views

CVE-2026-72782

CVE-2026-72782 affects Craft CMS versions 5.0.0-RC1–before 5.10.6 and 4.0.0-RC1–before 4.18.2. The underlying issue is that environment variables and secrets (via ${ENV_VAR}) can be interpolated into Twig templates during rendering, even with the Twig sandbox enabled. An authenticated attacker wi...

7.1CVSS5.4AI score0.00227EPSS
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 4 days ago9 views

Malicious code in camelot-ammv2-periphery (npm)

camelot-ammv2-periphery is a malicious npm package that impersonates Camelot DEX's AMM v2 periphery contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true...

5.6AI score
SaveExploits0References5
OSV
OSV
added 4 days ago7 views

MAL-2026-13739 Malicious code in ethereum-vault-connector (npm)

ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector EVC protocol. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js |...

5.6AI score
SaveExploits0References5
OSSF Malicious Packages
OSSF Malicious Packages
added 4 days ago9 views

Malicious code in ethereum-vault-connector (npm)

ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector EVC protocol. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js |...

5.5AI score
SaveExploits0References5
OSV
OSV
added 4 days ago5 views

MAL-2026-13772 Malicious code in camelot-ammv2-core (npm)

camelot-ammv2-core is a malicious npm package that impersonates Camelot DEX's AMM v2 core contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the...

5.6AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added 4 days ago2 views

PT-2026-70871

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCX TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

6.3CVSS5.3AI score0.00205EPSS
SaveExploits0References3
CVE
CVE
added 5 days ago32 views

CVE-2026-15467

Trustyai-service-operator vulnerability CVE-2026-15467 affects the LMEvalJob controller. An authenticated cluster user can abuse a sidecar container to bypass environment-variable filtering and security policies, enabling remote code execution within the cluster. CVSS 3.1 base score 8.1 (HIGH) wi...

8.1CVSS6.2AI score0.00381EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/07 8:9 p.m.7 views

SUSE-SU-2026:3536-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into...

7.5CVSS8.3AI score0.00374EPSS
SaveExploits1References5
Cvelist
Cvelist
added 2026/08/07 7:29 p.m.29 views

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

9.1CVSS0.00344EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/07 7:29 p.m.16 views

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

9.1CVSS5.4AI score
SaveExploits0References5
Rows per page
Query Builder