yolo-cage

yolo-cage: autonomous coding agents that do no harm You're a responsible engineer. You'd never just let an AI run roughshod through your most sensitive systems and codebases. That's why you'd never just shut off the safeguards for a tool like Claude Code. It asks permission for every dangerous...

git-alerts

GitAlerts ¿Qué problema resuelve? Los repositorios de GitHub creados bajo cualquier organización pueden ser controlados por los administradores de GitHub. Sin embargo, cualquier repositorio creado bajo la cuenta de un usuario de la organización no es controlable a menos que la organización haya...

In-Spectre-Meltdown

In-Spectre-Meltdown Esta herramienta permite verificar los ataques de canal lateral de ejecución especulativa que afectan a muchos procesadores modernos y diseños de sistemas operativos. CVE-2017-5754 Meltdown y CVE-2017-5715 Spectre permiten que procesos no privilegiados roben secretos de proces...

dracon-utilities

Dracon Utilities Three small Rust CLI tools that look after a Linux development machine: one keeps your git repos committed and backed up, one keeps your disk and memory from falling over, and one stops secrets from landing in your git history. They run as ordinary user-level systemd services — n...

redact

redact Strip credential-like content from free-form strings before they reach logs, telemetry, or any third-party surface Part of thephpboyscout Go toolkit — small, framework-free Go modules extracted from go-tool-base. Docs: redact.go.phpboyscout.uk gitlab.com/phpboyscout/go/redact redacts...

CVE-2026-27886-check

Herramienta de Evaluación de Vulnerabilidad CVE-2026-27886 Detecte de forma segura si una instancia de Strapi es vulnerable a CVE-2026-27886 sin realizar la cadena completa de apropiación de cuentas. Consulte el artículo completo en el blog de Bishop Fox. Descripción CVE-2026-27886 es un bypass d...

EUVD-2026-71260

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute pat...

CVE-2026-75033 Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

CVE-2026-75033

CVE-2026-75033 is a cross-cluster secret leakage vulnerability in Rancher Manager (before 2.15.1 ). Project Secrets were propagated into a namespace based solely on the field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. An ...

CVE-2026-73834

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

CVE-2026-73834

A flaw in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes allows ACM wrapper Custom Resources that embed Secret data to be collected without redaction . When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archiv...

CVE-2026-74876

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876 openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

opensslencrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.fromdict that creates key bundles from untrusted data without verifying signatures. Attackers can call fromdict followed by toidentity without signature verification to encrypt data using attacker-controlled public...

CVE-2026-74876

In openssl_encrypt before 1.4.0, PublicKeyBundle.from_dict() accepts untrusted key bundle data without signature verification. Attackers can craft a malicious bundle, call to_identity(), and encrypt secrets to an attacker-controlled public key, enabling confidential data exfiltration. CVSS 9.8 cr...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

GHSA-5PQ8-3FFP-7W5M hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

EUVD-2025-210715

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM...

EUVD-2026-55698

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret...