CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

CVE-2026-75915

CodeWhale versions before 0.8.64 fail to scrub parent process environment variables before spawning Node.js in the js_execution tool. Attackers executing malicious JavaScript via the tool can read process.env to exfiltrate API keys, cloud credentials, and auth tokens back to the model context. CV...

CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

Linux Distros Unpatched Vulnerability : CVE-2026-74265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the...

PT-2026-77145

Name of the Vulnerable Software and Affected Versions Pyenv versions prior to 2.8.0 Description The is version safe function in libexec/pyenv-version-file-read accepts shell glob metacharacters within .python-version values. Additionally, unquoted PYENV VERSION expansion in...

PT-2026-77235

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server functions.js before invoking...

PT-2026-77166

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description The js execution tool fails to scrub parent process environment variables before spawning Node.js. This allows attackers to execute malicious JavaScript code that reads process.env to leak sensiti...

libssh: libssh: information disclosure via ProxyCommand %r username expansion

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

SUSE-SU-2026:23205-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container bsc1269471...

Insufficient Verification of Data Authenticity

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

JLSEC-2026-1333

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPTSSLCIPHERLIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising...

PYSEC-2026-3766

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

PYSEC-2026-3766

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

CVE-2026-74890

openssl_encrypt versions before 1.4.0 have an authentication bypass in the CamelliaCipher component: setting the PYTEST_CURRENT_TEST environment variable disables HMAC tag generation and verification, allowing attackers with code execution to produce unauthenticated ciphertext and bypass integrit...

CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

BIT-AIRFLOW-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

PT-2026-76626

openssl encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST CURRENT TEST environment variable is set. Attackers with code execution can set this environment variable to produce...

PT-2026-73238

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099728)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099728 advisory. In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Fix an uninit variable access bug in qrtrtxresume Syzbot reported a bug as following:...