Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ansible (UTSA-2026-017472)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017472 advisory. A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower befo...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: vitess, runc, grafana-alloy-fips, beats-fips, kubevela-fips, reports-server, juicefs, chisel-fips, seaweedfs-rocksdb-fips, zitadel, rancher, prometheus-elasticsearch-exporter, prometheus-operator, kuma, jaeger, newrelic-fluent-bit-output-fips,...

CVE-2026-39825 vulnerabilities

Vulnerabilities for packages: vitess, runc, grafana-alloy-fips, beats-fips, kubevela-fips, reports-server, juicefs, chisel-fips, seaweedfs-rocksdb-fips, zitadel, rancher, prometheus-elasticsearch-exporter, prometheus-operator, kuma, jaeger, newrelic-fluent-bit-output-fips,...

GHSA-P9H5-JM8X-MJM5 vulnerabilities

Vulnerabilities for packages: vitess, cilium-certgen, crossplane-provider-aws-cloudwatch, juicefs, seaweedfs-rocksdb-fips, act, prometheus-elasticsearch-exporter, crossplane-provider-aws-s3control, crossplane-provider-aws-mediapackage-fips, kubernetes-csi-node-driver-registrar-fips, conftest,...

CVE-2026-42499 vulnerabilities

Vulnerabilities for packages: vitess, cilium-certgen, crossplane-provider-aws-cloudwatch, juicefs, seaweedfs-rocksdb-fips, act, prometheus-elasticsearch-exporter, crossplane-provider-aws-s3control, crossplane-provider-aws-mediapackage-fips, kubernetes-csi-node-driver-registrar-fips, conftest,...

CVE-2026-39820 vulnerabilities

Vulnerabilities for packages: vitess, cilium-certgen, crossplane-provider-aws-cloudwatch, juicefs, seaweedfs-rocksdb-fips, act, prometheus-elasticsearch-exporter, crossplane-provider-aws-s3control, crossplane-provider-aws-mediapackage-fips, kubernetes-csi-node-driver-registrar-fips, conftest,...

GHSA-XQ5J-9R39-C3VF vulnerabilities

Vulnerabilities for packages: vitess, cilium-certgen, crossplane-provider-aws-cloudwatch, juicefs, seaweedfs-rocksdb-fips, act, prometheus-elasticsearch-exporter, crossplane-provider-aws-s3control, crossplane-provider-aws-mediapackage-fips, kubernetes-csi-node-driver-registrar-fips, conftest,...

Microsoft says Edge’s plaintext password behavior is “by design”

Some time ago, we discussed whether you should allow your browser to remember your passwords. In that article we mentioned the importance of encryption. “ With a browser password manager, someone with access to your browser could see your passwords in clear text, although Windows can be set to as...

EUVD-2026-28526

UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contains a critical logic flaw in its policy enforcement pipeline. When a transaction originates from a "Pocket" a derived sub-address documented in the protocol a...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: step-issuer, gitlab-cng, azure-service-operator, grafana-alloy-fips, src, seaweedfs, juicefs, seaweedfs-rocksdb-fips, zitadel, kuma, keda, pgtimetable, temporal-server, steampipe, azure-service-operator-fips, sftpgo-plugin-eventstore, step-fips, spicedb, spire-server...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to improper handling of namespace deletion retries. An attacker can cause residual data, such as outstanding leases and unrelated storage entries, to remain after ...

CVE-2026-6706

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0...

CVE-2026-6706

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0...

EUVD-2026-26049

Improper access control in the vault documentation feature in Devolutions Server 2026.1.14.0 and earlier allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request...

CVE-2026-6706

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0...

CVE-2026-6706

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0...

PT-2026-35724

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.1.14.1 Description Improper access control in the vault documentation feature allows an authenticated attacker to read documentation content from unauthorized vaults by sending a crafted API request...

Devolutions Server 安全漏洞

Devolutions Server is an application system developed by the Canadian company Devolutions. It provides a fully functional solution for shared accounts and password management. Versions of Devolutions Server prior to 2026.1.14.0 contained security vulnerabilities. These vulnerabilities were caused...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator-fips, versitygw-fips, beats-fips, seaweedfs, cert-manager-istio-csr-fips, juicefs, seaweedfs-rocksdb-fips, zitadel, rancher, trufflehog-fips, external-secrets-operator, agentbeat-fips, xeol-fips, cloudbeat-fips, versitygw,...