CVE-2025-55000

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected...

CVE-2025-49830

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

CVE-2025-49828

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secre...

CVE-2025-49827

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.5 and 13.6 are vulnerable to bypass of the IAM authenticator. An attacker who can manipula...

CISA's NIMBUS 2000 Initiative: Understanding Key Findings and Strengthening Cloud Identity Security

This blog explores key findings from CISA’s NIMBUS 2000 Cloud Identity Security Technical Exchange and how Trend Vision One™ Cloud Security aligns with these priorities. It highlights critical challenges in token validation, secrets management, and logging visibility—offering insights into how...

CVE-2025-49829

Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted formerly Conjur...

CVE-2025-49830

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

CVE-2025-49830 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to path traversal and file disclosure

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

CVE-2025-49828 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secre...

CVE-2025-49827

CVE-2025-49827 affects CyberArk Conjur OSS (versions 1.19.5–1.22.0) and Secrets Manager, Self-Hosted (13.1–13.5, 13.6). Root cause is bypass of the IAM authenticator via manipulation of AWS-signed headers and a malformed regex that redirects the authentication validation request to a attacker-con...

PT-2025-29614 · Cyberark · Conjur +1

Name of the Vulnerable Software and Affected Versions: Conjur Secrets Manager, Self-Hosted versions prior to 13.5.1 and 13.6.1 Conjur OSS versions prior to 1.22.1 Description: Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager,...

MAL-2025-5285 Malicious code in react-plaid-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2e5a7cd6740a8b92b5b0c681bce252fd1850ace8501de899aea496321176c95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

App Platform Updates: Customizable Catalog, Git-Based Secrets Management, and Automated Management of K8s Projects

In this blog, we’ll shortly touch on App Platform’s new features and improvements, plus we’ll look ahead at some major changes that are in our pipeline...

CVE-2022-49899

In the Linux kernel, the following vulnerability has been resolved: fscrypt: stop using keyrings subsystem for fscryptmasterkey The approach of fs/crypto/ internally managing the fscryptmasterkey structs as the payloads of "struct key" objects contained in a "struct key" keyring has outlived its...

Badge and CyberArk Announce Partnership to Redefine Privacy in PAM and Secrets Management

San Francisco, CA, 8th October 2024, CyberNewsWire...

Doppler Launches ‘Change Requests’ to Strengthen Secrets Management Security with Audited Approvals

San Francisco, United States / California, 3rd October 2024, CyberNewsWire...

CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

End-to-End Secrets Security: Making a Plan to Secure Your Machine Identities

At the heart of every application are secrets. Credentials that allow human-to-machine and machine-to-machine communication. Machine identities outnumber human identities by a factor of 45-to-1 and represent the majority of secrets we need to worry about. According to CyberArk's recent research,...

Malicious code in secrets-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2bff791886c61ea5ea5f8d294fe5883cc6e253f105fd9a0f1b6e19e22f56a751 The OpenSSF Package Analysis project identified 'secrets-management' @ 99.3.0 npm as malicious. It is considered malicious because: - The packag...

MAL-2024-1180 Malicious code in secrets-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2bff791886c61ea5ea5f8d294fe5883cc6e253f105fd9a0f1b6e19e22f56a751 The OpenSSF Package Analysis project identified 'secrets-management' @ 99.3.0 npm as malicious. It is considered malicious because: - The packag...