CVE-2026-115707

Insertion of Sensitive Information into Externally-Accessible File or Directory CWE-538 in Elastic Cloud Enterprise ECE can lead to privilege escalation via Retrieve Embedded Sensitive Data CAPEC-37. After the ECE certificate rotation procedure runs, data that it retains contains platform...

EUVD-2026-112920

Insertion of Sensitive Information into Externally-Accessible File or Directory CWE-538 in Elastic Cloud Enterprise ECE can lead to privilege escalation via Retrieve Embedded Sensitive Data CAPEC-37. After the ECE certificate rotation procedure runs, data that it retains contains platform...

CVE-2026-115707

Elastic Cloud Enterprise (ECE) is vulnerable to CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory), where retained data from the certificate rotation procedure contains platform credentials and certificate authority private keys . If a lower-privileged compo...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

MAL-2026-5143 Malicious code in @redhat-cloud-services/javascript-clients-shared (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Lablup BackendAI security vulnerabilities

Lablup BackendAI is a machine learning platform from Lablup Korea. A security vulnerability exists in Lablup BackendAI that stems from the exposure of sensitive data in active sessions, which could lead to an attacker gaining access to management platform user credentials...