GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, kargo, trivy-operator, argo-cd-fips, falcoctl-fips, helm-push, cert-manager-cmctl, conftest-fips, ratify-fips, k9s-fips, tigera-operator, argocd-image-updater, gatekeeper, rancher-fleet-fips, conftest, steampipe, cloudbeat-fips,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, kargo, trivy-operator, argo-cd-fips, falcoctl-fips, helm-push, cert-manager-cmctl, conftest-fips, ratify-fips, k9s-fips, tigera-operator, argocd-image-updater, gatekeeper, rancher-fleet-fips, conftest, steampipe, cloudbeat-fips,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, kargo, trivy-operator, argo-cd-fips, falcoctl-fips, helm-push, cert-manager-cmctl, conftest-fips, ratify-fips, k9s-fips, tigera-operator, argocd-image-updater, gatekeeper, rancher-fleet-fips, conftest, steampipe, cloudbeat-fips,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, kargo, trivy-operator, argo-cd-fips, falcoctl-fips, helm-push, cert-manager-cmctl, conftest-fips, ratify-fips, k9s-fips, tigera-operator, argocd-image-updater, gatekeeper, rancher-fleet-fips, conftest, steampipe, cloudbeat-fips,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: chartmuseum, argo-cd, trivy, vcluster, conftest, helm-set-status, cluster-api-helm-controller, tw, gatekeeper, rancher-fleet, kargo, falcoctl, argocd-image-updater, steampipe, consul-k8s, helm-operator, eksctl, oras, kubescape-operator, maru, kyverno,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: chartmuseum, argo-cd, trivy, vcluster, conftest, helm-set-status, cluster-api-helm-controller, tw, gatekeeper, rancher-fleet, kargo, falcoctl, argocd-image-updater, steampipe, consul-k8s, helm-operator, eksctl, oras, kubescape-operator, maru, kyverno,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: chartmuseum, argo-cd, trivy, vcluster, conftest, helm-set-status, cluster-api-helm-controller, tw, gatekeeper, rancher-fleet, kargo, falcoctl, argocd-image-updater, steampipe, consul-k8s, helm-operator, eksctl, oras, kubescape-operator, maru, kyverno,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: chartmuseum, argo-cd, trivy, vcluster, conftest, helm-set-status, cluster-api-helm-controller, tw, gatekeeper, rancher-fleet, kargo, falcoctl, argocd-image-updater, steampipe, consul-k8s, helm-operator, eksctl, oras, kubescape-operator, maru, kyverno,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: chartmuseum, argo-cd, trivy, vcluster, conftest, helm-set-status, cluster-api-helm-controller, tw, gatekeeper, rancher-fleet, kargo, falcoctl, argocd-image-updater, steampipe, consul-k8s, helm-operator, eksctl, oras, kubescape-operator, maru, kyverno,...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: chartmuseum, argo-cd, trivy, vcluster, conftest, helm-set-status, cluster-api-helm-controller, tw, gatekeeper, rancher-fleet, kargo, falcoctl, argocd-image-updater, steampipe, consul-k8s, helm-operator, eksctl, oras, kubescape-operator, maru, kyverno,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: chartmuseum, argo-cd, trivy, vcluster, conftest, helm-set-status, cluster-api-helm-controller, tw, gatekeeper, rancher-fleet, kargo, falcoctl, argocd-image-updater, steampipe, consul-k8s, helm-operator, eksctl, oras, kubescape-operator, maru, kyverno,...

CVE-2026-54430

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

UBUNTU-CVE-2026-54430

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

CVE-2026-54430 Server-Site Request Forgery in liboauth2

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

Malicious code in @marketfront/header (npm)

The @marketfront/header package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

CVE-2026-13760

OS command injection in the NodejsFunction Docker bundling pipeline OsCommand helper in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected...

CVE-2026-13760 OS Command Injection in aws-cdk-lib Docker Bundling

OS command injection in the NodejsFunction Docker bundling pipeline OsCommand helper in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected...

Malicious code in date-fns-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4694a079d83e33dcee7f87140c41737009d9f0b19f351c23f2ae3dbce9a47a51 [email protected] presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs automatically on npm install. T...

PT-2026-54636

Name of the Vulnerable Software and Affected Versions aws-cdk-lib versions prior to 2.260.0 Description OS command injection exists in the NodejsFunction Docker bundling pipeline within the OsCommand helper. An actor who can control dependency version strings in a project's package.json file may...

MAL-2026-6701 Malicious code in ripshakti (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ce8c4b0c7a25d70f9043d4208694cdef5ad174aa493ee9e9097ea6693a668 The package's preinstall lifecycle hook scripts.preinstall = "node index.js" auto-executes index.js on npm install. The script queries the AWS instan...