PT-2025-37194

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description VMScape is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor like QEMU. The vulnerability allows a malicious virtual machin...

Yet Another Mirage of Breaking MIRAGE: Debunking Occupancy-Based Side-Channel Attacks on Fully Associative Randomized Caches

Recent work presented at USENIX Security 2025 claims that occupancy-based attacks can recover AES keys from the MIRAGE randomized cache. In this paper, we examine these claims and find that they arise from fundamental modeling flaws. Most critically, the authors' simulation of MIRAGE uses a...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview checkov is an Infrastructure as code static analysis Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere when cloning external modules from private registries. An attacker can obtain sensitive access keys by...

CVE-2025-2181

A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access keys in Checkov's output...

CVE-2025-2181

CVE-2025-2181 affects Palo Alto Networks Checkov by Prisma Cloud. The vulnerability is a sensitive information disclosure that can cause Prisma Cloud access keys to be exposed in Checkov’s output (cleartext). Multiple sources corroborate exposure of credentials via Checkov output during operation...

CVE-2025-2181 Checkov by Prisma Cloud: Cleartext Exposure of Credentials

A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access keys in Checkov's output...

CVE-2025-2181 Checkov by Prisma Cloud: Cleartext Exposure of Credentials

A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access keys in Checkov's output...

PT-2025-33021

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Checkov by Prisma® Cloud affected versions not specified Description: A sensitive information disclosure issue exists in Palo Alto Networks Checkov by Prisma® Cloud. This can lead to the cleartext exposure of Prisma Cloud...

Heracles: Chosen Plaintext Attack on AMD SEV-SNP

A whitepaper discussing an attack on AMD SEV-SNP called Heracles that was able to leak kernel memory, crypto keys, and user passwords, as well as demonstrate web session hijacking...

Palo Alto Networks Checkov 安全漏洞

Palo Alto Networks Checkov is a code static analysis tool from Palo Alto Networks USA. A security vulnerability exists in Palo Alto Networks Checkov, which stems from an information leak that could lead to the exposure of Prisma Cloud access keys in plaintext...

CVE-2025-55165

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the todict method, used ...

CVE-2025-55165

CVE-2025-55165 affects Autocaliweb prior to v0.8.3. The issue arises from the debug pack serialization (to_dict()) not filtering sensitive fields, potentially exposing API keys. Patch released in v0.8.3; mitigation is upgrade to 0.8.3+ or apply vendor workaround if available. Other connected sour...

CVE-2025-55165 Autocaliweb Exposure of Sensitive Information to an Unauthorized Actor in `config_sql.py`

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the todict method, used ...

CVE-2025-55165 Autocaliweb Exposure of Sensitive Information to an Unauthorized Actor in `config_sql.py`

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the todict method, used ...

CVE-2025-55165 Autocaliweb Exposure of Sensitive Information to an Unauthorized Actor in `config_sql.py`

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the todict method, used ...

curl: Exposure of Hard-coded Private Keys and Credentials in curl Source Repository (CWE-321)

Multiple private/test RSA keys and example credentials were discovered embedded in the public curl source repository and associated documentation. These sensitive secrets were detected using automated tools gitleaks and manual review. Their presence could allow attackers to impersonate trusted cu...

PT-2025-32945 · Unknown · Autocaliweb

Name of the Vulnerable Software and Affected Versions: Autocaliweb versions prior to 0.8.3 Description: Autocaliweb is a web application that provides an interface for browsing, reading, and downloading eBooks using a Calibre database. The debug pack generated by Autocaliweb can expose sensitive...

Jenkins ssh-agent Docker Image < 6.11.2 SSH Host Key Reuse

According to their self-reported version numbers, the jenkins/ssh-agent docker containers running on the remote web server are affected by an SSH host key reuse vulnerability. In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on...

Linux Distros Unpatched Vulnerability : CVE-2017-13305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974. CVE-2017-13305...

SolarWinds Database Performance Analyzer 信任管理问题漏洞

SolarWinds Database Performance Analyzer is an application from SolarWinds USA. A trust management issue vulnerability exists in SolarWinds Database Performance Analyzer, which stems from hard-coded encryption keys and could lead to a man-in-the-middle attack...