CVE-2026-39875-macOS-CUPS-LPE

CVE-2026-39875-macOS-CUPS-LPE Unprivileged user to root via CUPS vulnerability affecting macOS Tahoe, Sequoia, and Sonoma prior to macOS 26.6 / 15.7.8 / 14.8.8. Proof of Concept Demonstrations macOS Tahoe 26.4.1 macOS Sequoia 15.7.5 macOS Sonoma 14.8.5 Root Cause The vulnerability arises from two...

CVE-2026-76258

Splunk Secure Gateway's companion app registration handler uses a hard-coded cryptographic key, allowing non-admin/power users to register arbitrary callback URLs and redirect mobile user tokens to attacker-controlled endpoints. Splunk fixed this in Secure Gateway 3.8.71, 3.9.24, and 3.10.10; Ent...

GO-2026-5268 Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) in github.com/kyverno/kyverno

Kyverno apiCall automatically forwards ServiceAccount token to external endpoints credential leak in github.com/kyverno/kyverno...

EUVD-2026-23345

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16...

HashiCorp Vault 安全漏洞

HashiCorp Vault is a private key access management tool developed by the American company HashiCorp. Versions of HashiCorp Vault prior to 2.0.0, as well as versions prior to 1.21.5, 1.20.10, and 1.19.16, contain security vulnerabilities. These vulnerabilities stem from Vault’s practice of...

EUVD-2022-6075

Malicious code in bioql PyPI...

grafana: Forward OAuth Identity Token can allow users to access some data sources

An information-disclosure flaw was found in grafana. When a data source has the Forward OAuth Identity feature enabled, sending a query to that data source with an API token and no other user credentials will forward the OAuth Identity of the most recently logged-in user. This flaw allows API tok...