128 matches found
PT-2026-35724
Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.1.14.1 Description Improper access control in the vault documentation feature allows an authenticated attacker to read documentation content from unauthorized vaults by sending a crafted API request...
CVE-2026-34986 vulnerabilities
Vulnerabilities for packages: argo-workflows-fips, hydra-fips, gotrue, cloudbeat-fips, step-fips, zitadel, chainloop-cli, envconsul-fips, grafana-alloy, grafana-alloy-fips, packer, bank-vaults-fips, kiali-fips, clickhouse-backup, dex-fips, pulumi, vitess, flux-kustomize-controller,...
Incorrect Authorization
Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization when saving credentials. An authenticated user can access plaintext values of secrets stored in external vaults by referencing a secret's external name in a credential,...
PT-2026-26659
Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism...
CVE-2026-2590
Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by...
CVE-2026-27801
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass ...
Vaultwarden security vulnerabilities
Vaultwarden is an alternative implementation of the Bitwarden server API, developed by Daniel García. Versions of Vaultwarden 1.34.3 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the ability to bypass two-factor authentication when performing protected...
CVE-2026-2590
Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by...
CVE-2026-2590
Devolutions Remote Desktop Manager versions 2025.3.30 and earlier (and versions prior to 2026.1.6 ) are vulnerable to a sensitive information exposure flaw. The connection entry component fails to properly enforce the "Disable password saving in vaults" setting. This allows an authenticated user ...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: argo-workflows-fips, hydra-fips, pulumi-kubernetes-operator, backup-restore-operator, cloudbeat-fips, zitadel, kubernetes-csi-external-snapshotter, jaeger-operator, k8sgateway-fips, kuma, op-geth, rke2-runtime-fips, packer, jaeger-operator-fips, bank-vaults-fips,...
CVE-2025-11065 vulnerabilities
Vulnerabilities for packages: jitsucom-bulker, bank-vaults...
CVE-2025-11065 vulnerabilities
Vulnerabilities for packages: tkn-fips, kyverno, bank-vaults, zitadel, neuvector-sigstore-interface-fips, pluto-fips, jitsucom-bulker, grafana-fips, k9s-fips, beats-fips, ratify-fips, docker-compose-fips, boring-registry-fips, istio-fips, rancher-security-scan, mattermost-fips, beats,...
GHSA-FRHW-MQJ2-WXW2 vulnerabilities
Vulnerabilities for packages: age, promxy, gitleaks, kubernetes-csi-driver-nfs, vt-cli, skaffold, gostatsd, restic, harbor, falcosidekick, aws-node-termination-handler, sops, protoc-gen-go-grpc, docker-cli, protoc-gen-go, chart-testing, q, kubernetes-csi-livenessprobe, wuzz, kubelet-csr-approver,...
Malicious code in haedal-vaults-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4cdc575f935d62b37b17082181381a8002b5784fedda1dfc854ef2f74f39edf6 The OpenSSF Package Analysis project identified 'haedal-vaults-sdk' @ 1.6.0 npm as malicious. It is considered malicious because: - The package...
MAL-2025-48948 Malicious code in haedal-vaults-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4cdc575f935d62b37b17082181381a8002b5784fedda1dfc854ef2f74f39edf6 The OpenSSF Package Analysis project identified 'haedal-vaults-sdk' @ 1.6.0 npm as malicious. It is considered malicious because: - The package...
CVE-2025-11957: Authorization Bypass Through User-Controlled Key
Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests...
Information Disclosure
sigs.k8s.io/secrets-store-sync-controller is vulnerable to Information Disclosure. The vulnerability is due to improper error handling and service account tokens being logged during parameter marshaling errors, and attackers with log access can use these tokens to retrieve secrets from cloud vaul...
EUVD-2023-33890
Malicious code in bioql PyPI...