Monthly
Local information disclosure in the openssl-encrypt pip package (versions ≤ 1.4.8) exposes steganography passwords to all unprivileged users on the same Linux host. When the desktop GUI initiates an encrypt or decrypt operation involving the steganography feature, it spawns a CLI child process with the password supplied as the `--stego-password` command-line argument rather than via an environment variable, making it readable from `/proc/<pid>/cmdline` for the entire subprocess lifetime by any local user. The main encryption password is handled correctly via environment variable and is unaffected. A vendor-released patch is available in version 1.4.9; no public exploit has been identified at time of analysis.
Cleartext credential exposure in the ipa_getkeytab module of the community.general Ansible collection allows local users - or any principal with access to Automation Controller/AWX job logs - to recover the IPA/LDAP bind password supplied via bind_pw. The parameter is not marked no_log, causing the credential to appear verbatim in the system journal ('Invoked with' record), module return values, verbose Ansible output, AWX job logs, and the OS process list while ipa-getkeytab executes. No public exploit has been identified at time of analysis; exploitation is straightforward given log or process-table read access, requiring no special tooling.
Sensitive information disclosure in NVIDIA NemoClaw arises from process invocation that exposes secrets - such as API keys or authentication tokens - through visible command-line arguments or environment variables, observable by other local users via standard tools like `ps`. All versions are affected per the wildcard CPE (`cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*`), and exploitation requires only a low-privileged local account on the same system. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit code has been identified at time of analysis.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
Password exposure in openssl_encrypt before version 1.4.0 allows any local system user to capture plaintext encryption and keystore passwords by reading process argument listings. When operators pass credentials via the --password or -p CLI flags, those values appear verbatim in /proc/[pid]/cmdline and ps aux output on Linux/Unix multi-user systems. No public exploit is identified at time of analysis, though exploitation requires only standard POSIX utilities universally available on Linux; the CVSS 4.0 vector's AV:N designation appears miscalibrated - actual attack surface is local, meaningfully limiting real-world risk.
eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.
Information disclosure in Tanium Connect exposes sensitive data to local administrators via process invocation metadata. The vulnerability (CWE-214) allows a locally authenticated, highly privileged user to observe sensitive information - such as credentials or tokens - that the Connect component surfaces through visible process arguments or environment state. No active exploitation has been identified and no public proof-of-concept exists, but the high confidentiality impact (C:H) means exposed data could facilitate lateral movement or privilege escalation within the Tanium management plane.
ubuntu-pro-client (formerly ubuntu-advantage-tools) leaks Ubuntu Pro bearer tokens to unprivileged local users via the Linux /proc filesystem on all supported Ubuntu LTS releases from 14.04 through 26.04. When the client validates APT credentials, it spawns /usr/lib/apt/apt-helper with the secret token embedded in a cleartext URL argument (https://bearer:<token>@esm.ubuntu.com/), which any local low-privileged user can read from /proc/<pid>/cmdline on default-configured systems. The stolen token enables unauthorized access to the victim's Ubuntu Pro ESM repositories. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Sensitive information exposure in Pardus Domain Joiner (versions 0.5.2 up to but not including 0.5.4) lets a local low-privileged user harvest secrets — most plausibly domain-join credentials — that the tool passes as visible arguments when invoking a child process. TUBITAK BILGEM's utility enrolls Pardus (a Turkish Debian-based distribution) endpoints into a directory/domain, so the leaked material can be Active Directory or LDAP bind credentials. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix in 0.5.4 confirms the issue is vendor-acknowledged.
Environment variable leakage in OpenClaw (npm package, versions ≤2026.3.28) occurs because SSH-based sandbox backends pass the full unsanitized Node.js `process.env` object to SSH child processes, potentially exposing secrets such as API keys or credentials stored in the parent process environment. Exploitation is gated behind two non-default prerequisites: the SSH-based sandbox backend must be in use, and SSH environment variable forwarding must be enabled in the host's SSH daemon configuration. No active exploitation or public exploit code has been identified; EPSS sits at 0.01% (1st percentile) and SSVC rates exploitation as none, consistent with the vendor's own triage of this as a narrow, low-severity issue.
Local information disclosure in the openssl-encrypt pip package (versions ≤ 1.4.8) exposes steganography passwords to all unprivileged users on the same Linux host. When the desktop GUI initiates an encrypt or decrypt operation involving the steganography feature, it spawns a CLI child process with the password supplied as the `--stego-password` command-line argument rather than via an environment variable, making it readable from `/proc/<pid>/cmdline` for the entire subprocess lifetime by any local user. The main encryption password is handled correctly via environment variable and is unaffected. A vendor-released patch is available in version 1.4.9; no public exploit has been identified at time of analysis.
Cleartext credential exposure in the ipa_getkeytab module of the community.general Ansible collection allows local users - or any principal with access to Automation Controller/AWX job logs - to recover the IPA/LDAP bind password supplied via bind_pw. The parameter is not marked no_log, causing the credential to appear verbatim in the system journal ('Invoked with' record), module return values, verbose Ansible output, AWX job logs, and the OS process list while ipa-getkeytab executes. No public exploit has been identified at time of analysis; exploitation is straightforward given log or process-table read access, requiring no special tooling.
Sensitive information disclosure in NVIDIA NemoClaw arises from process invocation that exposes secrets - such as API keys or authentication tokens - through visible command-line arguments or environment variables, observable by other local users via standard tools like `ps`. All versions are affected per the wildcard CPE (`cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*`), and exploitation requires only a low-privileged local account on the same system. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit code has been identified at time of analysis.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
Password exposure in openssl_encrypt before version 1.4.0 allows any local system user to capture plaintext encryption and keystore passwords by reading process argument listings. When operators pass credentials via the --password or -p CLI flags, those values appear verbatim in /proc/[pid]/cmdline and ps aux output on Linux/Unix multi-user systems. No public exploit is identified at time of analysis, though exploitation requires only standard POSIX utilities universally available on Linux; the CVSS 4.0 vector's AV:N designation appears miscalibrated - actual attack surface is local, meaningfully limiting real-world risk.
eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.
Information disclosure in Tanium Connect exposes sensitive data to local administrators via process invocation metadata. The vulnerability (CWE-214) allows a locally authenticated, highly privileged user to observe sensitive information - such as credentials or tokens - that the Connect component surfaces through visible process arguments or environment state. No active exploitation has been identified and no public proof-of-concept exists, but the high confidentiality impact (C:H) means exposed data could facilitate lateral movement or privilege escalation within the Tanium management plane.
ubuntu-pro-client (formerly ubuntu-advantage-tools) leaks Ubuntu Pro bearer tokens to unprivileged local users via the Linux /proc filesystem on all supported Ubuntu LTS releases from 14.04 through 26.04. When the client validates APT credentials, it spawns /usr/lib/apt/apt-helper with the secret token embedded in a cleartext URL argument (https://bearer:<token>@esm.ubuntu.com/), which any local low-privileged user can read from /proc/<pid>/cmdline on default-configured systems. The stolen token enables unauthorized access to the victim's Ubuntu Pro ESM repositories. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Sensitive information exposure in Pardus Domain Joiner (versions 0.5.2 up to but not including 0.5.4) lets a local low-privileged user harvest secrets — most plausibly domain-join credentials — that the tool passes as visible arguments when invoking a child process. TUBITAK BILGEM's utility enrolls Pardus (a Turkish Debian-based distribution) endpoints into a directory/domain, so the leaked material can be Active Directory or LDAP bind credentials. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix in 0.5.4 confirms the issue is vendor-acknowledged.
Environment variable leakage in OpenClaw (npm package, versions ≤2026.3.28) occurs because SSH-based sandbox backends pass the full unsanitized Node.js `process.env` object to SSH child processes, potentially exposing secrets such as API keys or credentials stored in the parent process environment. Exploitation is gated behind two non-default prerequisites: the SSH-based sandbox backend must be in use, and SSH environment variable forwarding must be enabled in the host's SSH daemon configuration. No active exploitation or public exploit code has been identified; EPSS sits at 0.01% (1st percentile) and SSVC rates exploitation as none, consistent with the vendor's own triage of this as a narrow, low-severity issue.