VMware Spring Boot 信任管理问题漏洞

VMware Spring Boot is an open-source framework developed by the American company VMware. There were security vulnerabilities in versions 4.0.0 to 4.0.5 and 3.5.0 to 3.5.13 of VMware Spring Boot. These vulnerabilities stemmed from an issue where RabbitMQ automatically configured SSL bundles withou...

RabbitMQ auto-configuration with an SSL bundle disables TLS hostname verification

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, aws-privateca-issuer, sftpgo-plugin-eventsearch, osv-scanner, goreleaser, tailscale, flux-image-automation-controller, github-mcp-server, ingress-nginx-controller, flux-image-reflector-controller, dgraph, malcontent, newrelic-infra-operator,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: tetragon, gatus, redis-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, kafka-proxy, git-lfs, terraform-provider-random, minio-operator, clickhouse-operator, pguser, act, direnv, kyverno, fluxcd-kustomize-mutating-webhook, cue, hugo,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: nemo, grafana-rollout-operator, polaris-fips, aws-eks-pod-identity-agent-fips, rabbitmq-messaging-topology-operator-fips, karpenter, fluxcd-kustomize-mutating-webhook-fips, flux-source-watcher-fips, kyverno-policy-reporter-plugins-kyverno,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: nemo, grafana-rollout-operator, polaris-fips, aws-eks-pod-identity-agent-fips, rabbitmq-messaging-topology-operator-fips, karpenter, fluxcd-kustomize-mutating-webhook-fips, flux-source-watcher-fips, kyverno-policy-reporter-plugins-kyverno,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, tigera-operator, prometheus, splunk-otel-collector-fips, elastic-agent-fips, flux-fips, beats-fips, caddy, filebrowser, gitlab-rails-ce-fips, policy-controller, rancher-machine, sriov-network-device-plugin-fips, nerdctl, karpenter-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, tigera-operator, prometheus, splunk-otel-collector-fips, elastic-agent-fips, flux-fips, beats-fips, caddy, filebrowser, gitlab-rails-ce-fips, policy-controller, rancher-machine, sriov-network-device-plugin-fips, nerdctl, karpenter-fips,...

The vulnerability of RabbitMQ message brokers, related to the disclosure of information through registration files, allows attackers to gain unauthorized access to protected information.

The vulnerability of the RabbitMQ messaging broker is related to the exposure of information through registration files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CLEANSTART-2026-PI36812 Security fixes for CVE-2026-33186, ghsa-6v2p-p943-phr9, ghsa-c6gw-w398-hv78, ghsa-f6x5-jh6r-wrfv, ghsa-hcg3-p754-cr77, ghsa-j5w8-q4qc-rx2x, ghsa-qxp5-gw88-xv66, ghsa-v778-237x-gjrc, ghsa-vvgc-356p-c3xw applied in versions: 1.15.0-r1, 1.19.0-r0

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

BIT-RABBITMQ-C-2023-35789

An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for amqp-publish or amqp-consume and are thus visible to local attackers by listing a process and its arguments...

Malicious code in rabbitmq-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5fd48bd646ad6b2f173f479170d732395513c048f0c0f6148205c0e1d08f864 The package rabbitmq-sdk was found to contain malicious code...

MAL-2026-1831 Malicious code in rabbitmq-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5fd48bd646ad6b2f173f479170d732395513c048f0c0f6148205c0e1d08f864 The package rabbitmq-sdk was found to contain malicious code...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: docker-compose, tetragon, redis-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, kafka-proxy, terraform-provider-random, clickhouse-operator, pguser, kyverno, kubernetes-csi-livenessprobe, rabbitmq-messaging-topology-operator, skopeo, nri-mysql,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: docker-compose, tetragon, redis-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, kafka-proxy, terraform-provider-random, clickhouse-operator, pguser, kyverno, kubernetes-csi-livenessprobe, rabbitmq-messaging-topology-operator, skopeo, nri-mysql,...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: docker-compose, tetragon, nats-server-config-reloader, redis-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, kafka-proxy, terraform-provider-random, clickhouse-operator, pguser, mockgen, kyverno, kubernetes-csi-livenessprobe,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: docker-compose, tetragon, nats-server-config-reloader, redis-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, kafka-proxy, terraform-provider-random, clickhouse-operator, pguser, mockgen, kyverno, kubernetes-csi-livenessprobe,...

CLEANSTART-2026-CA79883 Security fixes for GHSA-6V2P-P943-PHR9, GHSA-C6GW-W398-HV78, GHSA-F6X5-JH6R-WRFV, GHSA-HCG3-P754-CR77, GHSA-J5W8-Q4QC-RX2X, GHSA-QXP5-GW88-XV66, GHSA-V778-237X-GJRC, GHSA-VVGC-356P-C3XW applied in versions: 1.15.0-r1

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-21473

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

Malicious Package

Overview @purecore/rabbitmq is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...