40897 matches found
CLEANSTART-2026-XI09971 Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET...
Security vulnerability affects the airflow-3 package. The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in...
CVE-2026-106145
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...
EUVD-2026-95523
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...
CVE-2026-106145
Progress Telerik Report Server prior to version 12.2.26.1007 is vulnerable to a privilege escalation flaw due to incorrect privilege assignment in the service-agent SignalR hub . An authenticated user, such as a low-privilege or guest account with a valid bearer token, can register as a trusted s...
gha-lab-3b0a828a69
Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gluestack/gluestack-ui at commit...
CLEANSTART-2026-QV19791 Security fix for GHSA-gcjh-h69q-9w9g applied in: external-secrets-operator-fips 2.12.0-r1, flux-helm-controller 1.6.4-r1
GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-IN42122 Security fix for GHSA-hrxh-6v49-42gf applied in: external-secrets-operator-fips 2.7.0-r1, node-problem-detector 0.8.25-r1
GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-UL53723 go-git is an extensible git implementation library written in pure Go
Security vulnerability affects the external-secrets-operator package. go-git is an extensible git implementation library written in pure Go...
CLEANSTART-2026-QV38909 go-git is an extensible git implementation library written in pure Go
Security vulnerability affects the external-secrets-operator package. go-git is an extensible git implementation library written in pure Go...
CLEANSTART-2026-QF15454 Security fix for GHSA-mpwr-8vm7-h73f applied in: external-secrets-operator-fips 2.7.0-r1
Security vulnerability affects the external-secrets-operator-fips package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-RV05686 Security fix for GHSA-cp6g-7hqx-qxhp applied in: external-secrets-operator-fips 2.7.0-r1
Security vulnerability affects the external-secrets-operator-fips package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-EU28747 mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS
Security vulnerability affects the external-secrets-operator-fips package. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS...
CVE-2026-106145: Incorrect Privilege Assignment
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...
MAL-2026-17727 Malicious code in @galicia-toolkit-nestjs-20/paas (npm)
@galicia-toolkit-nestjs-20/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...
Malicious code in @dransay/secrets (npm)
Source: amazon-inspector aef0f6b36413e45664391c5341f7c30a4501c2cc916add9ba6525bf57e559d51 The package declares a preinstall script that runs beacon.js, which performs a DNS lookup and HTTPS GET to a hardcoded Interactsh collector host db3klhbi6i9hark1kegg174t38h33b6wt.oast.site at npm install tim...
EUVD-2026-43182
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets...
GHSA-2XV2-W8CQ-5GXW PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
Summary CodeAgent.executepython executes LLM-generated Python code in a subprocess with the complete parent-process environment os.environ.copy, zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfigsandbox=True is explicitly set. This allows an attacker...
CVE-2026-93017
The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:...
CVE-2026-107604
A flaw in the Keycloak identity management service allows a realm administrator with the read-only view-clients role to retrieve the active primary secret of any confidential client. This occurs via the installation provider and client registration endpoints. The exposed secret can be used to imp...
EUVD-2026-95030
The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:...