GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env-fips, dgraph, gitness, docker-credential-acr-env...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, gitness, dgraph...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: rancher, kube-state-metrics, newrelic-fluent-bit-output, coredns, newrelic-infrastructure-agent, volume-modifier-for-k8s, dkron, amazon-cloudwatch-agent-operator, kaf, thanos, knative-client, trillian, bank-vaults, sftpgo-plugin-geoipfilter, terraform-provider-azapi,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: cargobump, rancher-system-agent, kube-state-metrics, scorecard, kaf, cloud-provider-gcp-cloud-controller-manager, chisel, hivemind, helm-set-status, maru, timescaledb-parallel-copy, portieris, kapp, delve, kbld, terraform-provider-tls, bazelisk,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: cargobump, rancher-system-agent, kube-state-metrics, scorecard, kaf, cloud-provider-gcp-cloud-controller-manager, chisel, hivemind, helm-set-status, maru, timescaledb-parallel-copy, portieris, kapp, wazero, delve, kbld, terraform-provider-tls, bazelisk,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: cilium-cli, kube-state-metrics, scorecard, kaf, trillian, bank-vaults, kubewatch, caddy, terraform-provider-aws, grpc-health-probe, flux-source-controller, prometheus-adapter, crossplane-provider-azure-sql, helm-push, kubeflow-katib, nerdctl,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: rancher, opa-envoy, db-operator, kube-state-metrics, addon-resizer, hcloud, coredns, vcluster, volume-modifier-for-k8s, amazon-cloudwatch-agent-operator, chisel, delve, bank-vaults, kbld, sftpgo-plugin-geoipfilter, envconsul, grafana-operator, cluster-autoscaler,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: opa-envoy, rancher-system-agent, db-operator, scorecard, gitea, trillian, terraform-provider-azapi, caddy, grpc-health-probe, fluent-bit-plugin-loki, kargo, steampipe, velero-plugin-for-microsoft-azure, victoriametrics-operator, cloudflared, rabbitmq-cluster-operator...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: cilium-cli, kube-state-metrics, hcloud, newrelic-fluent-bit-output, scorecard, volume-modifier-for-k8s, kaf, thanos, delve, bank-vaults, trillian, kubewatch, kyverno-policy-reporter-ui, caddy, grafana-operator, grpcurl, pulumi-kubernetes-operator, prometheus-adapter,...

Malicious code in dlmm-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ddf2d03d839f7eff709e78da1d6a85226cdd3b9171dbcb59a4a95c741e0773e The package's top-level module runs a report routine on import, and setup.py invokes the same import at install time. The routine collects environmen...

MAL-2026-13729 Malicious code in dlmm-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ddf2d03d839f7eff709e78da1d6a85226cdd3b9171dbcb59a4a95c741e0773e The package's top-level module runs a report routine on import, and setup.py invokes the same import at install time. The routine collects environmen...

Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

MAL-2026-13694 Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

CVE-2026-71235

CVE-2026-71235 affects Magistrala’s Rules Engine, where authenticated users can create rules with embedded Go or Lua scripts that execute server-side when IoT messages arrive. The Go engine (re/golang.go) runs scripts via Yaegi, exposing the full Go standard library (including os and net/http) wi...

Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

SummaryThe capability policy denies the env.get and env.loaddotenv modules by default, with the stated reason that they read arbitrary host environment variables API keys, DSNs and are a secret-exfil risk. But the workflow engine's variable resolver expands $env.VAR for any environment variable...

EUVD-2026-52428

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still...