Uncontrolled Search Path Element

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the bundled xmllint tool in the underlying dependency. An attacker can potentially influence the search path used for external libraries ...

JetBrains TeamCity < 2022.04.4 (CVE-2022-40979)

The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.4. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2022.04.4 environmental variables of password type could be logged when using custom Perforce executable CVE-2022-40979 Note that...

JetBrains TeamCity < 2021.2.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.2.3. It is, therefore, affected by multiple vulnerabilities: - JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. CVE-2022-25263 - In JetBrains TeamCity...

Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...

CVE-2026-68518

A flaw was found in Glances, an open-source system monitoring tool. This vulnerability allows an attacker to bypass input sanitization by using adjacent unescaped Mustache variables. When an administrator-configured action template renders attacker-controlled process or container fields, these...

CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

SUSE-SU-2026:23249-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2025-32728: fix logic error in DisableForwarding option bsc1241012. - CVE-2026-3497: information disclosure or denial of service due to uninitialized variables bsc1259642. - CVE-2026-35385: a file downloaded by scp may be installed setuid ...

PT-2026-79415

Name of the Vulnerable Software and Affected Versions Infracost versions prior to 0.10.45 Description Infracost allows the attachment of a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without verifying if the host is trusted. This...

CVE-2026-53541: Improper Input Validation

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

CVE-2026-14163

Octopus Server's deployment variable snapshot can expose sensitive variables in clear-text under certain circumstances, leading to confidentiality impact (CVSS 7.1 HIGH, network-accessible, low privileges required). Affected component is the deployment variable snapshot; no specific version range...

EUVD-2026-63209

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

EUVD-2026-62940

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

CVE-2026-64961: Authorization Bypass Through User-Controlled Key

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-16869 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables...

EUVD-2026-62755

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables...

CVE-2026-63640

A flaw was found in MagicMirror². When the hideConfigSecrets feature is enabled, a connected client can submit a secret placeholder in a socket payload. This causes the server to incorrectly expand the placeholder with sensitive environment variables, such as API tokens or credentials. This...