CVE-2026-34038

CVE-2026-34038: Injection de commande à distance authentifiée dans Coolify Ce dépôt contient la documentation et l'analyse de CVE-2026-34038 , une vulnérabilité critique d'injection de commande dans Coolify. Résumé Une vulnérabilité d'injection de commande à distance authentifiée CWE-78 dans...

CVE-2026-106499

A flaw was found in the Backstage Scaffolder backend. In environments configured with default environment secrets, an authenticated attacker with permissions to create or modify templates can cause secret-derived values to be recorded in task logs. This issue leads to information disclosure,...

CVE-2026-106504

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106499

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106504

The Backstage framework is vulnerable in the @backstage/plugin-scaffolder-backend package prior to version 4.1.0 . The root cause is sensitive information exposure within scaffolder task logs. An authenticated user capable of creating and reading tasks can observe sensitive values if a deployment...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106499 Backstage: Secret-derived values may be exposed in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or...

CVE-2026-106499

The Backstage framework, specifically the @backstage/plugin-scaffolder-backend package, is vulnerable in versions prior to 4.1.0 . The issue allows secret-derived values to be exposed in Scaffolder task logs when deployments configure sensitive scaffolder.defaultEnvironment.secrets and permit una...

CVE-2026-106499 Backstage: Secret-derived values may be exposed in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or...

CVE-2026-106499 Backstage: Secret-derived values may be exposed in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or...

EUVD-2026-93867

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

Sensitive Data Leakage

Snowflake drivers are vulnerable to Insertion of Sensitive Data Leakage. The vulnerability is due to sensitive data such as authentication tokens, encryption keys, pre-signed cloud-storage URLs, and SAML assertions being written to diagnostic logs, which allows an attacker with read access to the...

evtx-baseline

evtx-baseline Un dépôt hébergeant des journaux evtx de bonnes pratiques goodware contenant des exemples d'installation de logiciels et d'interactions utilisateur de base Dons win10-client.tgz par @phantinuss win11-client.tgz par @frack113 win7-x86.tgz par @pH-T win2022-evtx.tgz par @Neo23x0...

third-thoughts

أفكار ثالثة مشروع بحثي من Lightless Labs يدرس سلوك العامل الذكي AI agent على نطاق واسع من خلال تحليل متعدد التخصصات للمجموعات النصية ببساطة، رمي الأشياء على الحائط ورؤية ما يلتصق. سُمّي على اسم مفهوم Tiffany Aching من عالم Discworld: الأفكار الأولى تفكير العوامل، الأفكار الثانية تحليل العوامل...

[SECURITY] Fedora 45 Update: ocaml-logs-0.10.0-10.fc45

Logs provides a logging infrastructure for OCaml. Logging is performed on sources whose reporting level can be set independently. The log message report is decoupled from logging and is handled by a reporter. A few optional log reporters are distributed with the base library and the API lets you...

CVE-2026-106123: Replicating Malicious Code (Virus or Worm)

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...

PT-2026-107296

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package may expose secret-derived values within Scaffolder task logs. This occurs in deployments where sensitive scaffolder.defaultEnvironment.secrets are...

PT-2026-107301

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package allows sensitive information exposure within scaffolder task logs. An authenticated user with permissions to create and read scaffolder tasks can...