37428 matches found
CVE-2026-15218 Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...
CVE-2026-74893
opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...
CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets
opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...
CVE-2026-74893
opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...
BIT-AIRFLOW-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext
Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...
Windmill < 1.603.3 - SQL Injection
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...
Pre-Auth Takeover of Build Pipelines in GoCD
GoCD contains a critical information disclosure vulnerability whose exploitation allows unauthenticated attackers to leak configuration information including build secrets and encryption keys. id: CVE-2021-43287 info: name: Pre-Auth Takeover of Build Pipelines in GoCD author: dhiyaneshDk severity...
Kubernetes Dashboard <1.10.1 - Authentication Bypass
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...
Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation
A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...
Malicious code in svelte-goal-vim (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d128d7a297d31ef6d2f78f99fed27b13b669612a641872e85ed40f48d22fffe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @peptideventure/peptide-score-modifier (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fa351dd59830661fec220bea9d36a6b2c84b9107412e6dead9067002ca6f607 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: harbor, spire-controller-manager, kustomize, cluster-proportional-autoscaler, fscrypt, gostatsd, k8s-device-plugin, rancher-webhook, kuberlr, oauth2-proxy, kuberay-operator, rancher-agent, terraform, nodetaint, aws-signer-notation-plugin,...
CVE-2026-56862 vulnerabilities
Vulnerabilities for packages: harbor, spire-controller-manager, kustomize, cluster-proportional-autoscaler, fscrypt, gostatsd, k8s-device-plugin, rancher-webhook, kuberlr, oauth2-proxy, kuberay-operator, rancher-agent, terraform, nodetaint, aws-signer-notation-plugin,...
CVE-2026-64887 Airwall - Hardcoded Secrets
Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...
Malicious code in zip-bundle (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a990db9c306a25a8b0663088429ef5cf3939c32a9f8d6b1fc3066e8bf42a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in hrp9872 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3863301b783d96a98f60f37331d4a61f921e6dee3c5c35f8788df21da5fd549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in google-logging-utils-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60ff4b97c24301c3b850c5c7f2c1a6dfc07c695c2b19c879cc766373f1c2ded2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in saps_secplayground_npm_ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13fa9c8b7672d88eb66c92e717080df3e10efc1b6f881b2f7361af0a5a7fbb37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-22555
A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...
