75 matches found
CVE-2026-119290 Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...
CVE-2026-119290 Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...
CVE-2026-119290
The @zuke/core component in the Zuke build automation system for Deno is vulnerable to information disclosure in versions prior to 1.51.0 . The root cause is that the writeJobSummary function writes reportSummary(...) notes to GITHUB_STEP_SUMMARY without applying the redactor required to protect ...
CVE-2026-18036
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...
CVE-2026-87993: Insertion of Sensitive Information into Log File
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...
GO-2026-5849 Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec in github.com/fission/fission
Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec in github.com/fission/fission...
CVE-2026-57287
Jenkins Job Configuration History Plugin 1356.ve360da6c523a and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted...
EUVD-2026-33589
A bug in Apache Airflow's Variable response masker caused nested-key redaction triggered by secret-suffixed key names like password, token, secret, apikey to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nest...
CVE-2026-32690 Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to...
Apache Airflow Information Disclosure Vulnerability (CNVD-2026-00003)
Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow suffers from an information disclosure vulnerability th...
GHSA-FV47-PQH6-WXGQ Apache Airflow exposes secret values to authenticated UI users via rendered templates
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4, which fixes this...
Insertion of Sensitive Information Into Sent Data
Amendment This issue was found to be a duplicate. The original vulnerability with details can be found here. Credit: William Ashe...
Apache Airflow security vulnerabilities
Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow suffers from an information disclosure vulnerability th...
EUVD-2022-32098
Malicious code in bioql PyPI...
EUVD-2024-0003
Malicious code in bioql PyPI...
Missing Origin Validation in WebSockets
Overview Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the operations API response, which includes secret values used for authenticating WebSocket connections. An attacker can execute arbitrary commands with the privileges of another user by...
Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API
Impact LXD's operations API includes secret values necessary for WebSocket connections when retrieving information about running operations. These secret values are used for authentication of WebSocket connections for terminal and console sessions. Therefore, attackers with only read permissions...
CVE-2024-24939
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible...
CVE-2022-27221
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown strin...
UBUNTU-CVE-2025-0495
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry...