338 matches found
Malicious code in @cacheable/node-cache (npm)
npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...
CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
PT-2026-66499
Name of the Vulnerable Software and Affected Versions OpenCost versions prior to 1.121.0 Description Authentication is not properly enforced for the 'GET /helmValues' endpoint, which exposes the base64-decoded HELM VALUES environment variable containing cloud provider credentials. Furthermore, th...
CVE-2026-16481
A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...
CVE-2026-12715
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
EUVD-2026-45187
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
PT-2026-60778
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
GHSA-WVXF-4P9H-5VG9 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-38H5-PJW3-MQXF vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-RGJ9-VX7J-X86J vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-JHVQ-4R2H-7C2Q vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-3VVP-54WC-F6JR vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
CVE-2026-53260 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
CVE-2026-45945 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-XX4X-7C38-RPQ3 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
CVE-2026-43095 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
CVE-2026-45961 vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...
GHSA-5MCX-8CMV-FVGX vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp...