ALSA-2026:75571 Important: sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: sudo: TZ environment variable allows...

sudo security update

1.9.17p2-3.3 - CVE-2026-96512 sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization rhel-9.8.z Resolves: RHEL-267328...

Containerd Execution Environment Disclosure

The vulnerability of the Containerd execution environment is related to errors in handling links. Exploiting this vulnerability can allow an attacker to disclose protected information...

Important: sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: sudo: TZ environment variable allows...

Important: sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: sudo: TZ environment variable allows...

Malicious code in anthropic-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 500869e36b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511 The package publishes as anthropic-sdk and re-exports the official anthropic client's symbols from anthropic import ; re-exports of...

CentOS Linux 7 [TuxCare] Security Update: python-jinja2 (CENTOS7:CLSA-2026:1790708389)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790708389 advisory. - Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter...

PT-2026-104620

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get environment of the file goldenverba/components/util.py of the component generate stream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attac...

NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.8...

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...

NPM: Trigger.dev: Cross-environment deployment cancel

NPM: Trigger.dev: Cross-environment deployment cancel vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...

Trigger.dev: Cross-environment deployment cancel

Summary Trigger.dev isolates each project into multiple environments dev, staging, prod, and per-PR preview branches, each with its own secret API key — the environment is a trust boundary a dev/preview/CI key is lower-trust than a prod key. Most API routes enforce this by scoping resource lookup...

GHSA-4672-HWV6-GQ62 Trigger.dev: Cross-environment deployment cancel

Summary Trigger.dev isolates each project into multiple environments dev, staging, prod, and per-PR preview branches, each with its own secret API key — the environment is a trust boundary a dev/preview/CI key is lower-trust than a prod key. Most API routes enforce this by scoping resource lookup...

Environment Variable Exposure in Podman (CVE-2026-57231)

: A security vulnerability exists in Podman versions 1.8.1 through 5.8.3 related to the improper handling of environment variables. Container images defined with an environment variable key but no value can trick Podman into inheriting that variable from the host. Furthermore, the use of an...

gitpython: GitPython: Information disclosure via environment variable expansion in URL handling

A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted...

gitpython: GitPython: Information disclosure via environment variable expansion in URL handling

A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted...

rubygem-hammer_cli: command injection via insecure editor invocation

A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...

GO-2026-6594 Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod

Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod...

GO-2026-6571 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei...

CVE-2026-102628 Cadmos LTI exposure of sensitive information via debug mode

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled APPDEBUG=true, APPENV=local in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment,...