com.blazemeter.plugins:blazemeterjenkinsplugin (>=1.0-beta-1, <=1.08-beta-1), com.brianfromoregon:caliper-ci (2.1) +153 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.424)

org.jenkins-ci.main:jenkins-core MAVEN version 1.424 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.blazemeter.plugins:blazemeterjenkinsplugin =1.0-beta-1, =0.1, =0.9, =1.2.11, =1.4.0, =2.7.0...

com.coravy.hudson.plugins.github:github (>=1.9, <=1.9.1), org.jenkins-ci.main:jenkins-test-harness (1.448) +10 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.448)

org.jenkins-ci.main:jenkins-core MAVEN version 1.448 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =1.9, =1.3.0, =1.0.5, =2.6, =2.17 -...

com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.615)

org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...

org.jenkins-ci.main:jenkins-test-harness (1.586), org.jenkins-ci.main:jenkins-war (1.586) +5 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.586)

org.jenkins-ci.main:jenkins-core MAVEN version 1.586 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.586 - org.jenkins-ci.main:jenkins-war 1.586 -...

com.base2services.jenkins:github-sqs-plugin (>=1.0, <=1.5), org.jenkins-ci.main:jenkins-test-harness (1.451) +9 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.451)

org.jenkins-ci.main:jenkins-core MAVEN version 1.451 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.base2services.jenkins:github-sqs-plugin =1.0, =2.4, =1.1, =1.3 Source cves: CVE-2026-53438...

com.coravy.hudson.plugins.github:github (>=1.1, <=1.8), org.jenkins-ci.main:jenkins-test-harness (1.445) +7 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.445)

org.jenkins-ci.main:jenkins-core MAVEN version 1.445 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =1.1, =1.88, =1.1, =1.3 Source cves: CVE-2026-53438...

com.cloudbees.jenkins.plugins:mansion-cloud (>=1.16, <=1.28), com.cloudbees.jenkins.plugins:oki-docki (1.0) +64 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.532)

org.jenkins-ci.main:jenkins-core MAVEN version 1.532 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:mansion-cloud =1.16, =1.10, =1.4.0, =1.20, =1.532, =1.35, =1.45 -...

org.jenkins-ci.main:jenkins-test-harness (1.586), org.jenkins-ci.main:jenkins-war (1.586) +5 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.586)

org.jenkins-ci.main:jenkins-core MAVEN version 1.586 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.586 - org.jenkins-ci.main:jenkins-war 1.586 -...

com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.615)

org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...

com.coravy.hudson.plugins.github:github (>=0.5, <=0.8), com.sonyericsson.hudson.plugins.gerrit:build-config (>=1.2.2, <=1.2.9) +34 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.400)

org.jenkins-ci.main:jenkins-core MAVEN version 1.400 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =0.5, =1.2.2, =1.2.2, =2.3.0, =1.4, =1.8, =1.10, =0.1.2...

com.base2services.jenkins:github-sqs-plugin (>=1.0, <=1.5), org.jenkins-ci.main:jenkins-test-harness (1.451) +9 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.451)

org.jenkins-ci.main:jenkins-core MAVEN version 1.451 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.base2services.jenkins:github-sqs-plugin =1.0, =2.4, =1.1, =1.3 Source cves: CVE-2026-53436...

com.coravy.hudson.plugins.github:github (>=1.1, <=1.8), org.jenkins-ci.main:jenkins-test-harness (1.445) +7 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.445)

org.jenkins-ci.main:jenkins-core MAVEN version 1.445 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =1.1, =1.88, =1.1, =1.3 Source cves: CVE-2026-53436...

com.cloudbees.jenkins.plugins:mansion-cloud (>=1.16, <=1.28), com.cloudbees.jenkins.plugins:oki-docki (1.0) +64 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.532)

org.jenkins-ci.main:jenkins-core MAVEN version 1.532 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:mansion-cloud =1.16, =1.10, =1.4.0, =1.20, =1.532, =1.35, =1.45 -...

org.jenkins-ci.main:jenkins-test-harness (1.586), org.jenkins-ci.main:jenkins-war (1.586) +5 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.586)

org.jenkins-ci.main:jenkins-core MAVEN version 1.586 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.586 - org.jenkins-ci.main:jenkins-war 1.586 -...

GHSA-G759-4PXW-6692 @hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers

Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-697 Incorrect Comparison Summary AWS IAM trust policies can list more than one federated identity provider — for example, a role that accepts BOTH GitHub Actions OIDC and Google's OIDC. The GOIDC1 and GOIDC2 policy rules ar...

@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers

Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-697 Incorrect Comparison Summary AWS IAM trust policies can list more than one federated identity provider — for example, a role that accepts BOTH GitHub Actions OIDC and Google's OIDC. The GOIDC1 and GOIDC2 policy rules ar...

PT-2026-48474

Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.4.0 Description IAM-role policy checks can be bypassed when a role trusts multiple OIDC OpenID Connect providers. The issue occurs when the Principal.Federated field contains a JSON array of multiple...

CVE-2026-50023

creationtimestamp| type| source ---|---|--- 2026-06-09 23:27:47+00:00| published-proof-of-concept| https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3 2026-07-16 16:25:06+00:00| seen| https://bsky.app/profile/gamer191.bsky.social/post/3mqrnkyqtkc27 2026-07-16 16:25:06+00:00|...

CVE-2026-47253

creationtimestamp| type| source ---|---|--- 2026-06-09 21:19:22+00:00| published-proof-of-concept| https://github.com/julien040/anyquery/security/advisories/GHSA-j9rx-rppg-6hh4...

Malicious code in mcp-server-github (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 156761c4bd0e22759f082d7c030c241be12301dced1e58943c17aaacf9fe0958 Package squats the unscoped name mcp-server-github to intercept installs intended for the official @modelcontextprotocol/server-github. package.json...