GHSA-52V5-JR5W-GJXR vulnerabilities

Vulnerabilities for packages: pulumi, graalvm...

GHSA-XGJW-PM74-86Q4 vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48816 vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48815 vulnerabilities

Vulnerabilities for packages: pulumi, graalvm...

GHSA-XGJW-PM74-86Q4 vulnerabilities

Vulnerabilities for packages: pulumi...

GHSA-52V5-JR5W-GJXR vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48816 vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48815 vulnerabilities

Vulnerabilities for packages: pulumi...

GHSA-JFC7-64V2-MR8C vulnerabilities

Vulnerabilities for packages: pulumi, graalvm...

CVE-2026-48758 vulnerabilities

Vulnerabilities for packages: pulumi, graalvm...

GHSA-JFC7-64V2-MR8C vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48758 vulnerabilities

Vulnerabilities for packages: pulumi...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: gitlab-runner, commercial-grafana, trivy-operator, zot, drone, external-secrets-operator-fips, omnictl-multiarch, opentofu-fips, gitlab-workhorse-ce-fips, kaf, pulumi-kubernetes-operator, chainctl-fips, docker-cli-buildx, prometheus-operator, snyk-cli, packer-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: zot, omnictl-multiarch, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, crossplane-provider-aws-datasync, crossplane-provider-azure-security, crossplane-provider-azure-servicebus, crossplane-provider-azure-streamanalytics,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: zot, omnictl-multiarch, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, crossplane-provider-aws-datasync, crossplane-provider-azure-security, crossplane-provider-azure-servicebus, crossplane-provider-azure-streamanalytics,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: fulcio, rancher, crossplane-provider-aws-memorydb, cilium-cli, crossplane-provider-family-azure, k3s, docker, kubescape, terraform-provider-azapi, pulumi, policy-controller, wal-g, crossplane-provider-aws-sns, argocd-image-updater, syft, sops,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: fulcio, rancher, cilium-cli, crossplane-provider-family-azure, k3s, docker, kubescape, pulumi, policy-controller, wal-g, syft, argocd-image-updater, sops, step-kms-plugin, slsa-verifier, tflint, flux-kustomize-controller, cosign, kubernetes-dashboard,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: rancher, cilium-cli, k3s, kubescape, pulumi, syft, argocd-image-updater, step-kms-plugin, kubernetes-dashboard, pulumi-kubernetes-operator, gitea, loki, rancher-agent, trivy, snyk-cli, gomplate, nerdctl, pulumi-language-yaml, caddy, kyverno, grype, zarf, guac,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: loki, act, melange, skaffold, scorecard, terragrunt, trivy, trivy-operator, kubernetes, snyk-cli, gptscript, cloud-provider-aws, flux, chezmoi, kaf, kots, osv-scanner, cilium-cli, k3s, gomplate, opentofu, cert-manager, nuclei, prometheus, witness, fscrypt, cilium,...

@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name

Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-693 Protection Mechanism Failure Summary Pulumi gives every cloud resource a structured URN that includes the resource's type chain hulumi:baseline:aws:SecureBucket$aws:s3/bucketV2:BucketV2 and the logical name the develope...