CVE-2021-35296

CVE-2021-35296 REDACTED...

CVE-2022-36200

CVE-2022-36200 REDACTED...

CVE-2026-100543

OpenClaw npm package openclaw before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as...

CVE-2026-100543

OpenClaw npm package openclaw before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as...

CVE-2026-100543: Exposure of Sensitive Information to an Unauthorized Actor

OpenClaw npm package openclaw before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as...

MINI-7X9Q-JV5M-2HX3

Bulletin has no description...

MINI-JWXP-4WJ5-3G7Q

Bulletin has no description...

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

Summary hubuumclient diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models. Affected behavior Native reqwest::Error values retain the full request URL. Converting those errors into...

Untrusted Content Masking for Web Agents with Security Guarantees

Defenses that provide security guarantees against prompt injection attacks rely on strict isolation between trusted instructions and untrusted data. In text-based environments such as tool-use APIs, this separation arises naturally: agents can reason from interface definitions without ever...

CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...

PT-2026-53521

Content removed...

GO-2026-5550 Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output in github.com/couchbase/sync_gateway

Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output in github.com/couchbase/syncgateway. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-5574 OpenBao's Inline Auth Incorrectly Redacted Headers in github.com/openbao/openbao

OpenBao's Inline Auth Incorrectly Redacted Headers in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

HackTheBox

HackTheBox — Writeups, Tooling & Exploitation Pipelines A wor...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 - cPanel/WHM Authentication Bypass This reposi...

CVE-2026-48152

Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin permission or datasource-specific ownership/resource checks. The built-in Basic app user role maps to the WRITE permission set, which...

OpenBao's Inline Auth Incorrectly Redacted Headers

Impact OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source...

SUSE CVE-2025-12141

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit...

BIT-GRAFANA-2025-12141 Grafana Alerting Editors can edit destination of webhooks they did not create

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit...

PYSEC-2026-19

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to...