MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...

GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, x509-certificate-exporter-fips, external-secrets-fips, crossplane-provider-azure-servicelinker, x509-certificate-exporter, crossplane-provider-azure-servicebus, crossplane-provider-azure-notificationhubs,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, rootlesskit-fips, kubernetes-dashboard, cilium-cli, eksctl, crossplane-provider-azure-servicelinker, chainctl, crossplane-aws-provider-fips, apply-cve-bump, prometheus-fips, gatus, kyverno-fips, kine, etcd-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, rootlesskit-fips, kubernetes-dashboard, cilium-cli, eksctl, crossplane-provider-azure-servicelinker, chainctl, crossplane-aws-provider-fips, apply-cve-bump, prometheus-fips, gatus, kyverno-fips, kine, etcd-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kafkaconnect-fips, crossplane-aws-provider-fips, crossplane-provider-aws-iam-fips, restic-fips, crossplane-provider-aws-chime, crossplane-provider-aws-route53resolver, kyverno-fips, kine, buildah, frankenphp-8.4, terraform-provider-tls,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kafkaconnect-fips, crossplane-aws-provider-fips, crossplane-provider-aws-iam-fips, restic-fips, crossplane-provider-aws-chime, crossplane-provider-aws-route53resolver, kyverno-fips, kine, buildah, frankenphp-8.4, terraform-provider-tls,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, cloud-provider-aws, flux-source-controller, rootlesskit, cilium-cli, knative-serving, kubernetes, steampipe, kots, slsa-verifier, vault-benchmark, flux-notification-controller, external-dns, witness, terragrunt, falcoctl,...

CVE-2026-52783

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...

CVE-2026-52783

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...

GO-2026-5710 Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus...

GO-2026-5544 opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension

opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension...

GO-2026-5358 Fleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet

Fleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the PKCS7 signature verification process for Azure instance identity. An attacker can obtain agent tokens without authentication by bypassing signature validation. Remediation There is...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the PKCS7 signature verification process for Azure instance identity. An attacker can obtain agent tokens without authentication by bypassing signature validation. Remediation Upgrade...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the PKCS7 signature verification process for Azure instance identity. An attacker can obtain agent tokens without authentication by bypassing signature validation. Remediation There is...

GO-2026-5196 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

Coder: PKCS7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the PKCS7 signature verification process for Azure instance identity. An attacker can obtain agent tokens without authentication by bypassing signature validation. Remediation Upgrade...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the PKCS7 signature verification process for Azure instance identity. An attacker can obtain agent tokens without authentication by bypassing signature validation. Remediation There is...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the PKCS7 signature verification process for Azure instance identity. An attacker can obtain agent tokens without authentication by bypassing signature validation. Remediation Upgrade...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Azure Instance Identity Endpoint process. An attacker can access internal resources or sensitive information by sending crafted requests to the affected endpoint without authentication. Remediati...