CVE-2026-76054None▾ SunlitInvocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient proce…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.
Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92171Medium· 6.5Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
CVE-2026-113495Medium· 5.0Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
CVE-2026-113496Medium· 5.0Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
CVE-2026-80158Medium· 5.5Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings
CVE-2026-109971Medium· 4.7A flaw was found in the clevis PKCS#11 pin
CVE-2025-53860Medium· 4.1A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) information on F5 rSeries systems. Note: Software versions which have reached End o…