CVE-2026-126838

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

EUVD-2026-124640

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

PT-2026-146002

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

CVE-2026-126838: MongoDB Rust Driver: A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service…

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

EUVD-2026-120520

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring che...

CVE-2026-125357

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring che...

UBUNTU-CVE-2026-125357

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring che...

CVE-2026-125357: munin-monitoring munin: Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of…

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring che...

CVE-2026-125357 Munin munin-httpd through 2.999.18 Path Traversal via Static File Handler

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring che...

CVE-2026-125357

The Munin munin-httpd server versions 2.99.1 through 2.999.18 are susceptible to a path traversal vulnerability in the Munin::Master::HTML::handle_request static file handler. This flaw allows unauthenticated attackers to bypass the /../ substring check by requesting /static/../. Successful explo...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the connections API, which fails to mask the config extra field declared as sensitive by the apprise provider. Because the name-based masking logic only checks a fixed global list of secret field...

PT-2026-141178

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring...

CVE-2026-107474: Apache Software Foundation Apache Airflow: The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed…

The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are...

CVE-2026-59386

A flaw was found in Cloud Foundry Controller CAPI. An authenticated user with SpaceSupporter permissions can improperly modify an application's start command or buildpack configuration, operations that should require elevated privileges. This privilege escalation can allow the unauthorized...

CVE-2026-59386

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks...

CVE-2026-59386 Credential exposure to space supporter

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks...

CVE-2026-59386

In the Cloud Foundry Foundation platform, a privilege escalation vulnerability allows a SpaceSupporter to modify an application's start command and buildpack , actions that should be restricted to SpaceDeveloper privileges. Exploiting this, an attacker can use malicious start commands or custom b...

CVE-2026-59386

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks...

EUVD-2026-113753

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks...

CVE-2026-59386 Credential exposure to space supporter

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks...