conjur

Conjur Maintainability Test Coverage Conjur provides secrets management and application identity for modern infrastructure: Machine Authorization Markup Language "MAML" , a role-based access policy language to define system components & their roles, privileges and metadata A REST web service to:...

vault

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

wrongsecrets

OWASP WrongSecrets Welcome to the OWASP WrongSecrets game! The game is packed with real life examples of how to not store secrets in your software. Each of these examples is captured in a challenge, which you need to solve using various tools and techniques. Solving these challenges will help you...

cottage

cott age is a GitOps tool for teams to manage age-encrypted secrets in git repositories. It provides a simple workflow to encrypt/decrypt secrets, manage recipients, and keep secrets out of the repo while still allowing for easy sharing via VCS. cottage also generates redacted previews of encrypt...

envsec

envsec Secure environment secrets management using native OS credential stores. Demo Features Store secrets in your OS native credential store not plain text files Cross-platform: macOS, Linux, Windows Organize secrets by context e.g. myapp.dev, stripe-api.prod, work.staging Track secret metadata...

GO-2024-2982 vulnerabilities

Vulnerabilities for packages: vault...

GO-2026-5377 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-5723 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-5426 vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, step-issuer, vitess, podinfo, azure-service-operator, k9s, cluster-api-aws-controller, kubernetes-csi-external-provisioner, src, vault-env, jaeger-operator, terraform-provider-google, seaweedfs, juicefs, crossplane-provider-aws-ec2,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth, git-sync, seaweedfs, rook, temporal-server, zarf, chartmuseum, weaviate, gitsign, trivy, ko, grafana-mimir, flux-source-controller, spire-server, zot, gitness, falcoctl, velero-plugin-for-microsoft-azure, crossplane-provider-azure-sql,...

Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.1.1

external secrets operator for Red Hat OpenShift 1.1.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...

BIT-OPENBAO-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

[SECURITY] Fedora 43 Update: openbao-2.5.4-1.fc43

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 43 Update: openbao-2.5.3-1.fc43

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

[SECURITY] Fedora 44 Update: openbao-2.5.2-1.fc44

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

CVE-2026-40264

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

CVE-2026-40264

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

CVE-2026-39946

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...

CVE-2026-33758

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...

EUVD-2026-16624

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishin...