CVE-2026-123368

The compose-lint Docker Compose security linter is vulnerable to information disclosure in versions 0.22.0 through 0.31.0 (specifically affecting include project_directory links from 0.28.0 ). The root cause is the failure to apply containment checks when following symbolic links outside the proj...

CVE-2026-54146

The OpenHuman desktop application and Rust library (versions 0.53.15 before 0.57.5 ) on macOS are vulnerable to a bearer token leak. The core_process.rs file in the Tauri desktop process incorrectly publishes the OPENHUMAN_CORE_TOKEN in the process environment, even though the core runs as an in-...

CVE-2026-54146 OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)

OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, coreprocess.rs in the Tauri desktop process publishes the per-launch OPENHUMANCORETOKEN bearer credential in its process environment even though the core now runs as...

CVE-2026-116246

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environmen...

CVE-2026-116246

In pgAdmin 4 versions prior to 9.19 , a vulnerability exists where the server manager writes server passwords into the shared process environment (as PGPASSWORD or per-process variables) for psql and other background utilities. Because this environment is shared across all user requests and inher...

EUVD-2026-114387

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environmen...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76054

CVE-2026-76054 affects Black Duck blackduck-c-cpp versions 1.0.17 through 3.0.6 . When the Black Duck API token is supplied via the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable, it is inherited by subprocesses launched during build capture and signature scanning. An actor able to exec...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76375: Insertion of Sensitive Information into Log File

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

EUVD-2026-61079

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

Malicious code in wormgpt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c The package's bin entries wormgpt-cli, wormgpt, deepholegpt, wgpt map to bin/victim.js, which silently spawns a detached implant on any invocation...

MAL-2026-13347 Malicious code in javas-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb8d6c5cf1104be2efdc1b3e6ff2e6dbc19f8b5036f87f6edaf99116216c0c53 javas-crypto ships a postinstall hook package.json line 11: "postinstall": "node setup.js" and a top-level autoExecute in index.js that both enumerat...

MAL-2026-13346 Malicious code in hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013 On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory...

Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

Malicious code in @zzzcrypto/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0 On require of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package...

Malicious code in rpc-endpoint-rotator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname,...

Malicious code in @wethenorth12/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...

Malicious code in @wethenorth12/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f602036ff9f524298056528fbec6c58c9fb66ea2686bec418694b5854aeea4 On require, index.js collects the full process.env object together with hostname, username, home directory, platform, current working directory, and ...