CVE-2026-40975

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15...

CVE-2026-40975

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15...

CVE-2026-40975

CVE-2026-40975 describes use of a cryptographically weak PRNG for Spring Boot’s random value property source (e.g., ${random.value}, ${random.int}, ${random.long}) used for secrets. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (...

PT-2026-35547

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, knative-kafka-broker-fips, blob-csi-fips, cert-manager-google-cas-issuer, vault, step-issuer, gitlab-cng-fips, kapp, crossplane-provider-aws-emr-fips, crossplane-provider-aws-autoscaling, crossplane-provider-azure-storagecache,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, knative-kafka-broker-fips, blob-csi-fips, cert-manager-google-cas-issuer, vault, step-issuer, gitlab-cng-fips, kapp, crossplane-provider-aws-emr-fips, crossplane-provider-aws-autoscaling, crossplane-provider-azure-storagecache,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: gitlab-runner, db-operator, cloudflared, crossplane-provider-aws-ec2, crossplane-provider-aws-lambda, yunikorn-k8shim, crossplane-provider-aws-sqs, node-problem-detector, kubernetes-csi-driver-hostpath, undock, gitlab-pages, prometheus, cloud-provider-vsphere,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: gitlab-runner, db-operator, cloudflared, crossplane-provider-aws-ec2, crossplane-provider-aws-lambda, yunikorn-k8shim, crossplane-provider-aws-sqs, node-problem-detector, kubernetes-csi-driver-hostpath, undock, gitlab-pages, prometheus, cloud-provider-vsphere,...

[SECURITY] Fedora 44 Update: trivy-0.69.3-1.fc44

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more...

[SECURITY] Fedora 44 Update: openbao-2.5.2-1.fc44

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

Security Bulletin: IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability (CVE-2026-6389)

Summary IBM Turbonomic Prometurbo is an agent used by IBM Turbonomic Application Resource Management to integrate with Prometheus to collect application metrics and send them to Turbonomic for analysis and generation of optimization plans. A security vulnerability has been addressed in the IBM...

CVE-2026-41478

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through...

CVE-2026-41478 Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through...

CVE-2026-41478

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through...

CVE-2026-41478 Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: gitlab-runner, kyverno, flux-source-controller, juicefs, flux, ratify, yunikorn-k8shim, bento, minio, k6, sftpgo-plugin-auth, seaweedfs, grafana, cert-manager-csi-driver, opentofu, dex, trufflehog, cert-manager-istio-csr, telegraf, frp, cert-manager-cmctl, spqr,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: gitlab-runner, kyverno, flux-source-controller, juicefs, flux, ratify, yunikorn-k8shim, bento, minio, k6, sftpgo-plugin-auth, seaweedfs, grafana, cert-manager-csi-driver, opentofu, dex, trufflehog, cert-manager-istio-csr, telegraf, frp, cert-manager-cmctl, spqr,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: k6-fips, cert-manager-openshift-routes-fips, cert-manager-cmctl, cert-manager-cmctl-fips, cert-manager-google-cas-issuer, vault, rclone-fips, cloudbeat, harbor-fips, kyverno-notation-aws-fips, trufflehog, external-secrets-operator-fips, openbao, bento-fips,...

SecScan

SecScan Local-LLM-powered security scanner for GitHub repos...

MAL-2026-3025 Malicious code in next-rwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b11e0d18d15210fc1b53ccc943f01bd8f2d6873d4dd2586d535336fb14de6662 The package next-rwa was found to contain malicious code. Source: ghsa-malware 7f7d55fa4afccd86d6cbe53d7ad7643039f7e0bc251a0cb9b149708720c87639 Any...