CVE-2026-85514: Improper Privilege Management

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...

CVE-2026-85617: Authorization Bypass Through User-Controlled Key

snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions...

PT-2026-85592

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

Malicious code in agent-free (npm)

The npm package agent-free is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes t...

CVE-2026-75431

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-75431

PowerJob Server version 5.1.2 (and likely earlier) suffers from a predictable JWT signing key used for HS256-based authentication, allowing a remote attacker with no prior access to forge valid tokens and execute arbitrary code . The vulnerability is rated CVSS 9.1 (Critical) with high confidenti...

CVE-2026-85147: Improper Access Control

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication...

EUVD-2026-71448

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

CVE-2026-75431: Use of Hard-coded Cryptographic Key

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

MAL-2026-16011 Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

PT-2026-85685

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

PT-2026-85427

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

CVE-2026-71216: Cleartext Transmission of Sensitive Information

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

Malicious code in prime-coding-agent (npm)

The npm package prime-coding-agent is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. It is a pure-JS proxy dist/index.js: it reads the developer's provider API keys e.g. process.env.EXAAPIKEY, NVIDIAAPIKEY, configured provider...

PT-2026-85749

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys...

Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

PT-2026-85522

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api key api.user leads to improper privilege management. The attack may be...

MAL-2026-16012 Malicious code in orbitron-cli (npm)

The npm package orbitron-cli is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

PT-2026-85586

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/tool id or GET /tool endpoints to retrieve plaintext authorization headers and...

CVE-2026-80114: Use of Hard-coded Cryptographic Key

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...