MAL-2026-13812 Malicious code in hfkcdyuwbdx1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c3d2f214c9d9ba8dcc912ba18272665044c75eb18d8335c18b959687d45cbdb Package [email protected] was scanned but produced no concrete findings from either rule-based checks or contextual code tracing. The package name i...

Malicious code in jkbnwsdf8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e67b8d2fe8ba4fcec395d1fa7497515b41f2e4edc7f25e12c2b4b4abcebe358 The package contains a single file, index.html, declared as the package main. The HTML is styled as a Cloudflare Turnstile 'Just a moment...' challen...

Malicious code in @bikli/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494fd55b20aca27d1d7353454574b7575074d84eee1367b6854c159f274c4dcc No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files contain no evidence of...

CVE-2026-73122

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

CVE-2026-64927

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

EUVD-2026-57061

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

CVE-2026-73122 Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

EUVD-2026-57060

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

PT-2026-71138

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow...

CVE-2025-59325

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details...

CVE-2025-59325

CPSD CryptoPro Secure Disk for BitLocker versions before 7.7.4 fails to encrypt initramfs contents, allowing attackers with physical access to recover secrets and cryptographic keys offline. CVSS 7.5 (HIGH) reflects high confidentiality impact with low complexity. No public exploit code is provid...

PT-2026-71361

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where the ServiceAccount of the component is bound to a ClusterRole that grants cluster-wide permissions to get, list, and watch secrets, exceeding the actual requiremen...

PT-2026-71049

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

EUVD-2025-210718

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details...

PT-2026-71127

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The environment-variable secrets backend incorrectly resolves team-scoped Connections or Variables from the wrong team's scope. This occurs because the security guard intended to prevent this...

CVE-2025-59325

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets and cryptographic details...

PT-2026-71116

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

PT-2026-71141

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker fails to mask var.json Variable values when the value is a dictionary within the Rendered Templates UI. This occurs because the dictionary value fails an isinstancestr guard...

CVE-2026-73230 Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...

CVE-2026-73083

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...