CVE-2026-82282

Atlantis (through version 0.47.1 ) contains an authentication bypass in the /github-app/setup endpoint. The endpoint fails to require authentication, allowing unauthenticated callers to observe or intercept the GitHub redirect during app setup and extract the RSA private key and webhook secret . ...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

EUVD-2026-67803

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82265 Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify...

CVE-2026-82265 Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify...

CVE-2026-82265

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on its tracing API port without authentication. This allows unauthenticated attackers to read environment variables , bean configurations , and storage credentials , or to modify log levels to suppress logging. The vulnerability is netwo...

CVE-2026-82181

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

CVE-2026-54745 Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...

Malicious code in 3layerdipstackvcdkrp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e942d987e7abce19624bf16a6e376f8a607a87d963d8838737e7b923b0ab4b92 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackr5ga2v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74ce455e7a19e84189c13631dc62f53159d44c67920b1579ab3feb779614bcb6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackbndk47 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 348dc9c5c9f9b067e597312e0e8228c5bddb04ca7573801a6ae27ab9809cb520 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack1lkqg9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3055362817a22386f2c0e5db959db42444b9c60d620c9c8453ee196a1d0e8fe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack8lj8gm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72671b2191d5c2a662d2b435a09fa42f2bbc26997aea63f216ac6a8a81779076 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14642 Malicious code in 3layerdipstack6ih5ru (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20a2c09619d3e25f0b44bfcaaac14edd03b62c113f3fb7d3fc88e29bc27a986d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackfdgka0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b1e8e507446d2e1921511d47721fa25899b90432339713bbaac218908d68b8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack1eognp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cff722257765397d39ae1e9d1b93bc298de19ee2f1ace23154f41e3166f9227a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack5eariu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fa6e95c5789c6347f7ce7dbfeade0d5d0838717acb211f09758af985e7f4f0d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14740 Malicious code in 3layerdipstackelcuhp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb13b3a8a98b196d368a547d115510504e1a70d7d0235125cee48cc81dbef936 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...