EUVD-2026-62925

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

CVE-2026-76360

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

CVE-2026-76360 Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

CVE-2026-76360

Splunk SOAR versions below 8.6.0 are affected by a missing authorization check on the /rest/health endpoint, allowing authenticated users with no role to retrieve restricted system and cluster telemetry; CVSS 4.3 MEDIUM, remediation is to upgrade to version 8.6.0. Exploitation details are not pro...

Malicious code in ngsw-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b427c73f093ad680033b2779c43c1c96186a71055aaff3cf44befd18c2cecbd The package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node version, package/lifecycle name...

Malicious code in chromecast-webdriver-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c858cd5357d77c39366f7bd1cc1985a5d7012d33da45d6dc9667544b54198d6 [email protected] runs a postinstall lifecycle script that collects host metadata os.hostname, platform, arch, node version, package nam...

Malicious code in chrome-enterprise-premium-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850bd071a15b1c20097032c5861cdfdeb970d05b4e28f65d5bcdb411fba5d10d chrome-enterprise-premium-mcp ships a postinstall lifecycle script that fires automatically on npm install and POSTs installer host metadata...

Malicious code in mtslink-depconf-probe-profileusername (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f679922753b7a59c59af851ae74275b5d4760b13fc516bc8c68e8e9568393dc6 Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.c...

CVE-2026-74892

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

EUVD-2026-60111

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74892

The openssl_encrypt package (versions before 1.4.0) ships a hardcoded default secret key in its standalone telemetry server configuration, used for API key hashing. Attackers who know this key can forge API key hashes to bypass telemetry API authentication. CVSS 3.1 rates this HIGH (7.5) due to r...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

EUVD-2026-60112

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74892 openssl_encrypt before 1.4.0 Hardcoded Secret Key

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

CVE-2026-74892 openssl_encrypt before 1.4.0 Hardcoded Secret Key

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

CVE-2026-74892

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

CVE-2026-74893

openssl_encrypt (PyPI package) versions before 1.4.0 hardcode default JWT signing secrets in config.py that bypass validation checks. Anyone with source-code access can forge valid JWT tokens for any client_id, gaining authenticated access to keyserver and telemetry APIs. CVSS 3.1 score is 8.8 (H...

CVE-2026-74880

The openssl_encrypt package (before 1.4.0) accepts refresh tokens as URL query parameters in its keyserver and telemetry server routes. Because URLs are logged in server logs, proxy logs, browser history, and HTTP Referer headers, attackers can extract these tokens to gain unauthorized access. Th...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...