CVE-2026-59326 HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-44191

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44189

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...

CVE-2026-44190

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44191

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

CVE-2026-44191 Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

EUVD-2026-47655

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

CVE-2026-44191

The CVE-2026-44191 entry concerns the Visual Studio Code Ansible Lightspeed extension. It describes a command injection (CWE-78) caused by improper handling of ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts, enabling an attacker to inject shell separat...

CVE-2026-44191

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

EUVD-2026-47653

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187

The CVE-2026-44187 vulnerability affects the Ansible Lightspeed extension for Visual Studio Code. It allows a local attacker or malware operating with the user’s privileges to read the Google Gemini API key because the extension stores the credential in plaintext in the user’s configuration file ...

EUVD-2026-47651

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44190

The CVE concerns the Ansible Lightspeed Visual Studio Code extension. A Command Injection (CWE-78) arises from the ansible.python.activationScript setting, which is meant for a virtual environment activation script but does not properly validate the input as a file path. Triggering this via a spe...

CVE-2026-44190

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44189 Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filename

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...

CVE-2026-44189 Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filename

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...

EUVD-2026-47650

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...

CVE-2026-44189

The CVE concerns Visual Studio Code Ansible Lightspeed extension (AnsiblePlaybookRunProvider). The vulnerability stems from unsanitized special characters in a playbook filename, enabling command injection and arbitrary code execution with the user’s privileges when the playbook is run. Impact in...

CVE-2026-44189

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...