GO-2026-6220 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint in github.com/fleetdm/fleet

Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint in github.com/fleetdm/fleet...

MAL-2026-14120 Malicious code in blastradar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eccd07c931ee578e1201f5fbb7f4610fd5291202c0fcee2b30c959c80c871e The package's index.js loads childprocess, https, and fs at the top level and performs an HTTPS POST that carries host- and installer-identifying dat...

MAL-2026-14122 Malicious code in ulebkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9 index.js unconditionally requires./perf.js on load. perf.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, /.aws/credentials, /.aws/config, and...

PT-2026-77155

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the must-gather component allows certain ACM wrapper Custom Resources that embed Secret data to be collected without redaction. When an...

Malicious code in reseller-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5e549688dcd67cfcc86be1c65c7831f7c730036626c41484332cf7dca2d7fee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-15218 Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...

Malicious code in sugarball-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-74893

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893

openssl_encrypt (PyPI package) versions before 1.4.0 hardcode default JWT signing secrets in config.py that bypass validation checks. Anyone with source-code access can forge valid JWT tokens for any client_id, gaining authenticated access to keyserver and telemetry APIs. CVSS 3.1 score is 8.8 (H...

BIT-AIRFLOW-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

BIT-AIRFLOW-2026-68076 Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

BIT-AIRFLOW-2026-59244 Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

PT-2026-73238

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...

Malicious code in svelte-goal-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ad94557dcf8609bd1dbec00633fa3850e30f977d894850f983cf127bb05c1ca The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @peptideventure/peptide-score-modifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9087a96f9eff6ac558764d4ba1ec4427d1d251447f891d1a62b58ee764d9ab1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: azure-workload-identity-webhook, prometheus, amass, trufflehog, grafana-alloy, lazygit, pvc-autoresizer, aws-flb-firehose, crossplane, rancher-telemetry, crossplane-provider-aws-ec2, kitty, ghaudit, sealed-secrets, kuberlr, harbor-registry, mongodb-kubernetes-operato...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: azure-workload-identity-webhook, prometheus, amass, trufflehog, grafana-alloy, lazygit, pvc-autoresizer, aws-flb-firehose, crossplane, rancher-telemetry, crossplane-provider-aws-ec2, kitty, ghaudit, sealed-secrets, kuberlr, harbor-registry, mongodb-kubernetes-operato...