Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-03 | 1 | Disclosure1 |
| 2026-04-07 | 1 | Patch1 |
I heard you like CVEs, so I reported CVEs in your CVE filing software. Just reported and fixed CVE-2026-35466 & CVE-2026-35467 in CVEClient. Massive thanks to @CERTCC for the world-class coordination. This is how CVD is done. 🛡️ https://github.com/CERTCC/cveClient
Post summary
The author reported two CVEs and states they were fixed in CVEClient, praising CERTCC for coordination.
CVE-2026-35467 The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption cr… https://www.cve.org/CVERecord?id=CVE-2026-35467
Post summary
The post announces CVE‑2026‑35467, noting that API keys stored in a temporary browser client lack protection and can be extracted through the JavaScript console, highlighting the vulnerability’s exposure risk.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cmu | cveclient | - | - | - |