1015 matches found
CVE-2026-43105 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu, linux-vmware, linux-aws, linux-azure...
CVE-2026-43500 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu, linux-qemu-melange, linux-vmware, linux-aws, linux-qemu-rc, linux-azure...
GHSA-3W37-M4PG-Q585 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu, linux-vmware, linux-aws, linux-azure...
CVE-2026-43107 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu, linux-vmware, linux-aws, linux-azure...
CVE-2026-43108 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu, linux-vmware, linux-aws, linux-azure...
CVE-2026-31591 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu, linux-vmware, linux-aws, linux-azure...
com.datasqrl.flinkrunner:stdlib-json (>=0.9.0-alpha1 <=0.9.0-alpha2), com.datasqrl:sqrl-discovery (>=0.9.0-alpha1 <=0.9.0-alpha2) +14 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.1.0 <=2.1.1)
org.apache.flink:flink-table-runtime MAVEN version =2.1.0, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =26.0.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-35194 Source advisory: OSV:GHSA-2F54-V4HM-FX73...
Malicious Package
Overview apple-infra-gcp-leak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in @mistralai/mistralai-gcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcfd7fec176cc54232767b454429a7b3e0106aebbb16f2e9bdacc57e8a20ff9 The package @mistralai/mistralai-gcp was found to contain malicious code. Source: ghsa-malware...
MAL-2026-3512 Malicious code in @mistralai/mistralai-gcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcfd7fec176cc54232767b454429a7b3e0106aebbb16f2e9bdacc57e8a20ff9 The package @mistralai/mistralai-gcp was found to contain malicious code. Source: ghsa-malware...
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
@blinkk/root-cms (>=2.0.0 <=2.4.7), @cravery/core (=0.0.2) +8 more potentially affected by unknown CVE via @mistralai/mistralai-gcp (=1.7.0)
@mistralai/mistralai-gcp NPM version =1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on @mistralai/mistralai-gcp and may be impacted: - @blinkk/root-cms =2.0.0, =0.9.7, =0.2.11, =0.0.1, =2.1.4, =0.0.694, =0.0.1, =0.8.11, =0.8.14 Source cves: unknow...
CVE-2026-33814 vulnerabilities
Vulnerabilities for packages: rancher-system-upgrade-controller, nri-apache, kubernetes-event-exporter, spark-operator, prometheus, tigera-operator, aws-eks-pod-identity-agent, harbor-registry, cilium-certgen, trufflehog, redpanda, nerdctl, wal-g, cortex, crossplane-provider-keycloak, azure-ipam,...
ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0 <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-M2 <=4.0.0.0-M3) +157 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0-M1 <=5.0.1)
org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0-M1, =8.0.0, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M2, =6.0.0-beta.2, =6.0.0-beta.2, =6.0.0-beta.2, =6.0.0-beta.2, =6.0.0-beta.2, =6.0.0-beta.2, =1.0.0, =1.0.0, =2.0.0-RC1, =8.0.4 and more S...
CVE-2026-40981
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater...