netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...

GHSA-2MC4-J865-9Q4R netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...

CVE-2026-77066

The scanFeedsResolver in Omnivore's API passes user-supplied URLs directly to axios.get without validation, unlike the guarded subscribe path. An authenticated user can force internal requests, leaking feed-shaped metadata and probing internal ports. CVSS 3.1 base score is 5.0 (MEDIUM). No in-the...

WordPress Sunshine Photo Cart plugin < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure vulnerability

Unauthenticated Private Gallery Comment Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.6.12...

EUVD-2026-62950

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...

EUVD-2026-63113

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...

CVE-2026-76385

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...

CVE-2026-76261

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...

CVE-2026-76385 Information Disclosure through Action Parameters in Venafi app for Splunk SOAR

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...

CVE-2026-76261 Insecure Default Access Control List through the REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...

CVE-2026-76261

Non-admin/low-privilege users on Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Secure Gateway (below 3.10.9, 3.9.23, 3.8.70) can read Spacebridge asymmetric private keys via the App Key Value Store REST API. The root cause is incomplete private-key migration during upgrade, leaving...

CVE-2026-54741

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with...

CVE-2026-68559

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

CVE-2026-54741 Lemmy: Blocked users can edit private messages sent before the block

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with...

CVE-2026-54741 Lemmy: Blocked users can edit private messages sent before the block

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with...

CVE-2026-54741

In Lemmy (versions before 0.19.19 and 1.0.0-alpha.18), the edit_private_message function in crates/api/api_crud/src/private_message/update.rs only verifies the caller is the original message creator, skipping the recipient block-list check that create_private_message performs. This allows a block...

EUVD-2026-62843

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with...

CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

EUVD-2026-62700

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

CVE-2026-68559

Wekan (open-source kanban board built with Meteor) is affected by a broken access control vulnerability in the /api/boards/:boardId/exportExcel route (versions 9.57 through 9.74 ). The root cause is that the asynchronous exporterExcel.canExport(user) authorization guard in models/server/ExporterE...