MAL-2026-6031 Malicious code in @mastra/otel-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1998b4d1e4f2d960197b14f573628777e4456ff374f007ac39cca273a206aea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/otel-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1998b4d1e4f2d960197b14f573628777e4456ff374f007ac39cca273a206aea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/otel-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a8b6a73558d739f5ae803c6330009938e0a19f5c6a1a7c0f01cf4884fbea9b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5958 Malicious code in @mastra/otel-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a8b6a73558d739f5ae803c6330009938e0a19f5c6a1a7c0f01cf4884fbea9b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

SUSE-SU-2026:21989-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: Update to version 20260430.00 Update THIRDPARTYLICENSES to be package specific location. 608 Update dependencies and go version to 1.26.2 607 bsc1265762, CVE-2026-33814 Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 604...

Cross-site Scripting (XSS)

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Cross-site Scripting XSS via the otelCarrier query parameter being directly inserted into an inline script without sanitization. An attacker can execute arbitrary JavaScript in the context...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: nri-f5, pulumi, rook, cert-manager-csi-driver, cilium-cli, kubernetes-dashboard-metrics-scraper, cis-operator, flux, argocd-image-updater, polaris, vertical-pod-autoscaler, filebrowser, cluster-api-ipam-provider-in-cluster, custom-pod-autoscaler-operator,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: telegraf, tempo, amazon-cloudwatch-agent, crossplane-provider-aws-kinesis, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, crossplane-provider-aws-kms, crossplane-provider-aws-eks, crossplane-provider-aws-cloudwatchlogs,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-azure, crossplane-provider-gcp-fips, crossplane-provider-aws-firehose, tempo, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-rolesanywhere-fips, crossplane-provider-aws-sns, crossplane-provider-aws-ecr-fips,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-azure, crossplane-provider-gcp-fips, crossplane-provider-aws-firehose, tempo, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-rolesanywhere-fips, crossplane-provider-aws-sns, crossplane-provider-aws-ecr-fips,...

Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)

Dependency on Vulnerable Third-Party Component in Elastic OTel Java Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component CWE-1395 exists in Elastic OTel Java via a dependency on OpenTelemetry Java instrumentation library. This vulnerability could allow an attacker to...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, pulumi, tekton-pipelines, cilium-cli, ksops, pulumi-language-java, flux, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, polaris, vertical-pod-autoscaler, src, pulumi-language-dotnet, crossplane-provider-aws-elasticache,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: kube-logging-operator, pulumi, tekton-pipelines, cilium-cli, ksops, pulumi-language-java, flux, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, polaris, vertical-pod-autoscaler, src, pulumi-language-dotnet, crossplane-provider-aws-elasticache,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, apko-fips, kube-vip-fips, omni-fips, gitlab-cng-fips, crossplane-provider-aws-firehose, timoni, tempo, crossplane-provider-aws-servicediscovery-fips, dex, step-issuer-fips, crossplane-provider-aws-rolesanywhere-fips, linkerd2-fips,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, apko-fips, kube-vip-fips, omni-fips, gitlab-cng-fips, crossplane-provider-aws-firehose, timoni, tempo, crossplane-provider-aws-servicediscovery-fips, dex, step-issuer-fips, crossplane-provider-aws-rolesanywhere-fips, linkerd2-fips,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: node-feature-discovery, spicedb-fips, blob-csi, secrets-store-csi-driver-provider-gcp, kong-ingress-controller, kubernetes-csi-external-health-monitor, prometheus-alertmanager, falcosidekick, cass-operator-fips-no-pvc-delete, temporal, pulumi-kubernetes-operator,...

AZL-78653 CVE-2026-27141 affecting package azl-otel-collector 0.127.0-1

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, cilium-cli, kubernetes-dashboard-metrics-scraper, cis-operator, flux, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, polaris, vertical-pod-autoscaler, custom-pod-autoscaler-operator, crossplane-provider-aws-elasticache, hydra,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, cilium-cli, gobump, kubernetes-dashboard-metrics-scraper, cis-operator, flux, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, polaris, hivemind, vertical-pod-autoscaler, custom-pod-autoscaler-operator,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: amazon-k8s-cni, lvm-driver, node-feature-discovery, harbor-registry-fips, crossplane-provider-aws-firehose, mcp-grafana, nats, terraform-provider-random-fips, addon-resizer, rancher-fleet-fips, aws-efs-csi-driver, supercronic, blob-csi, prometheus-node-exporter-fips,...