Monthly
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
Password exposure in openssl_encrypt before version 1.4.0 allows any local system user to capture plaintext encryption and keystore passwords by reading process argument listings. When operators pass credentials via the --password or -p CLI flags, those values appear verbatim in /proc/[pid]/cmdline and ps aux output on Linux/Unix multi-user systems. No public exploit is identified at time of analysis, though exploitation requires only standard POSIX utilities universally available on Linux; the CVSS 4.0 vector's AV:N designation appears miscalibrated - actual attack surface is local, meaningfully limiting real-world risk.
Sensitive information exposure in Pardus Domain Joiner (versions 0.5.2 up to but not including 0.5.4) lets a local low-privileged user harvest secrets — most plausibly domain-join credentials — that the tool passes as visible arguments when invoking a child process. TUBITAK BILGEM's utility enrolls Pardus (a Turkish Debian-based distribution) endpoints into a directory/domain, so the leaked material can be Active Directory or LDAP bind credentials. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix in 0.5.4 confirms the issue is vendor-acknowledged.
Local information disclosure in Red Hat Clevis's PKCS#11 pin lets an already-logged-in, low-privileged local user capture the PKCS#11 token PIN that clevis-decrypt-pkcs11 passes as a command-line argument to pkcs11-tool, from where it is readable through process listing or /proc/<pid>/cmdline. The issue affects Clevis as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and carries a CVSS 3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact but a local-only, high-complexity attack requiring a non-default configuration. Exploitation requires the PKCS#11 pin to be configured, a decryption operation to be in flight at the same moment, and the attacker to win a timing race against the short-lived pkcs11-tool process; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis.
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.
Local information disclosure in microsandbox before 0.5.10 exposes sandbox secret values - host-side API keys, tokens and environment secrets - to any other local user or co-resident process on the same host, which can simply read them from the sandbox process command line while the sandbox is running. The Rust SDK serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments, keeping them visible in /proc/<pid>/cmdline on Linux and process listings on macOS for the entire sandbox lifetime, with no code execution inside the sandbox and no access to the spawning user's session required. Rated CVSS 3.1 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, medium), the flaw is only exploitable on shared/multi-tenant hosts, CI runners and developer systems where an adversary holds a separate local account or co-tenant process, and only leaks data when secrets were actually configured; no public exploit code has been identified at time of analysis, and the issue is fixed in 0.5.10.
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local user to read plaintext VM credentials - including passwords - that the component passes directly on process command-line arguments during VM creation or installation. Exploitation is timing-dependent: the secret is only readable while a provisioning operation is in flight, and it also requires that /proc process arguments remain visible to other users (i.e., the host is not hardened with a hidepid-style mount option), so risk concentrates on multi-user or shared virtualization hosts. It yields no code execution and no privilege escalation, but a disclosed password compromises access to the affected VM; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV).
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local attacker who can enumerate other users' process arguments to read guest VM installation credentials such as rootPassword and userPassword. The credentials are passed by install_machine.py as a JSON command-line argument during VM creation, so exposure is limited to the window while an administrator's installation workflow is running and depends on the host's process-visibility policy (e.g. /proc without hidepid=2). Publicly available exploit code exists, but there is no confirmed active exploitation; the issue requires local access plus a concurrently active install and cannot be triggered remotely or unauthenticated.
Local information disclosure in the cockpit-machines package on Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 lets an unprivileged local user capture a Red Hat Subscription Management (RHSM) offline token that is passed as a command-line argument to a helper script during token validation. Rated 5.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), the impact is confidentiality-only: a local account that can read other processes' metadata (for example /proc/<pid>/cmdline via ps) must catch the brief window in which a privileged operator runs the validation, and the stolen token can then be exchanged for RHSM access tokens. There is no public exploit code identified at time of analysis and no CISA KEV entry; Red Hat tracks the issue as CVE-2026-92745 (EUVD-2026-83260).
Local information disclosure in the openssl-encrypt pip package (versions ≤ 1.4.8) exposes steganography passwords to all unprivileged users on the same Linux host. When the desktop GUI initiates an encrypt or decrypt operation involving the steganography feature, it spawns a CLI child process with the password supplied as the `--stego-password` command-line argument rather than via an environment variable, making it readable from `/proc/<pid>/cmdline` for the entire subprocess lifetime by any local user. The main encryption password is handled correctly via environment variable and is unaffected. A vendor-released patch is available in version 1.4.9; no public exploit has been identified at time of analysis.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
Password exposure in openssl_encrypt before version 1.4.0 allows any local system user to capture plaintext encryption and keystore passwords by reading process argument listings. When operators pass credentials via the --password or -p CLI flags, those values appear verbatim in /proc/[pid]/cmdline and ps aux output on Linux/Unix multi-user systems. No public exploit is identified at time of analysis, though exploitation requires only standard POSIX utilities universally available on Linux; the CVSS 4.0 vector's AV:N designation appears miscalibrated - actual attack surface is local, meaningfully limiting real-world risk.
Sensitive information exposure in Pardus Domain Joiner (versions 0.5.2 up to but not including 0.5.4) lets a local low-privileged user harvest secrets — most plausibly domain-join credentials — that the tool passes as visible arguments when invoking a child process. TUBITAK BILGEM's utility enrolls Pardus (a Turkish Debian-based distribution) endpoints into a directory/domain, so the leaked material can be Active Directory or LDAP bind credentials. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix in 0.5.4 confirms the issue is vendor-acknowledged.
Local information disclosure in Red Hat Clevis's PKCS#11 pin lets an already-logged-in, low-privileged local user capture the PKCS#11 token PIN that clevis-decrypt-pkcs11 passes as a command-line argument to pkcs11-tool, from where it is readable through process listing or /proc/<pid>/cmdline. The issue affects Clevis as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and carries a CVSS 3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact but a local-only, high-complexity attack requiring a non-default configuration. Exploitation requires the PKCS#11 pin to be configured, a decryption operation to be in flight at the same moment, and the attacker to win a timing race against the short-lived pkcs11-tool process; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis.
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.
Local information disclosure in microsandbox before 0.5.10 exposes sandbox secret values - host-side API keys, tokens and environment secrets - to any other local user or co-resident process on the same host, which can simply read them from the sandbox process command line while the sandbox is running. The Rust SDK serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments, keeping them visible in /proc/<pid>/cmdline on Linux and process listings on macOS for the entire sandbox lifetime, with no code execution inside the sandbox and no access to the spawning user's session required. Rated CVSS 3.1 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, medium), the flaw is only exploitable on shared/multi-tenant hosts, CI runners and developer systems where an adversary holds a separate local account or co-tenant process, and only leaks data when secrets were actually configured; no public exploit code has been identified at time of analysis, and the issue is fixed in 0.5.10.
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local user to read plaintext VM credentials - including passwords - that the component passes directly on process command-line arguments during VM creation or installation. Exploitation is timing-dependent: the secret is only readable while a provisioning operation is in flight, and it also requires that /proc process arguments remain visible to other users (i.e., the host is not hardened with a hidepid-style mount option), so risk concentrates on multi-user or shared virtualization hosts. It yields no code execution and no privilege escalation, but a disclosed password compromises access to the affected VM; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV).
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local attacker who can enumerate other users' process arguments to read guest VM installation credentials such as rootPassword and userPassword. The credentials are passed by install_machine.py as a JSON command-line argument during VM creation, so exposure is limited to the window while an administrator's installation workflow is running and depends on the host's process-visibility policy (e.g. /proc without hidepid=2). Publicly available exploit code exists, but there is no confirmed active exploitation; the issue requires local access plus a concurrently active install and cannot be triggered remotely or unauthenticated.
Local information disclosure in the cockpit-machines package on Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 lets an unprivileged local user capture a Red Hat Subscription Management (RHSM) offline token that is passed as a command-line argument to a helper script during token validation. Rated 5.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), the impact is confidentiality-only: a local account that can read other processes' metadata (for example /proc/<pid>/cmdline via ps) must catch the brief window in which a privileged operator runs the validation, and the stolen token can then be exchanged for RHSM access tokens. There is no public exploit code identified at time of analysis and no CISA KEV entry; Red Hat tracks the issue as CVE-2026-92745 (EUVD-2026-83260).
Local information disclosure in the openssl-encrypt pip package (versions ≤ 1.4.8) exposes steganography passwords to all unprivileged users on the same Linux host. When the desktop GUI initiates an encrypt or decrypt operation involving the steganography feature, it spawns a CLI child process with the password supplied as the `--stego-password` command-line argument rather than via an environment variable, making it readable from `/proc/<pid>/cmdline` for the entire subprocess lifetime by any local user. The main encryption password is handled correctly via environment variable and is unaffected. A vendor-released patch is available in version 1.4.9; no public exploit has been identified at time of analysis.