EUVD-2026-92131

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-93318: Improper Validation of Integrity Check Value

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

CVE-2026-105676: Improper Limitation of a Pathname to a Restricted Directory

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...

CVE-2026-105165

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105165 devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105165

The devopspolis secrets-replicator (versions up to 0.4.0 ) is vulnerable to an issue in the AssumeRole Handler component. Specifically, the process_single_secret function in src/handler.py allows for incorrect permission assignment due to the manipulation of the external_id argument. This vulnera...

CVE-2026-105165 devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105165 devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

EUVD-2026-92051

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105165: Incorrect Permission Assignment for Critical Resource

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

PT-2026-104651

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process single secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external id leads to incorrect permission assignment. The attack can be...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

PT-2026-104595

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/option name to retrieve plaintext AI provider API...

GHSA-FJ2X-MQQP-3V2W Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...

NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.8...

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...

NPM: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

NPM: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

Summary Self-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from hosting/docker/.env.example are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise. Vulnerability Details The...

GHSA-PQXW-G93W-HJ9X Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

Summary Self-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from hosting/docker/.env.example are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise. Vulnerability Details The...