287 matches found
CVE-2026-26010
OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services Glue / Redshift / Postgres. Any read-only user can gain access to a highly privileged account, typically which has the...
CVE-2026-26010
OpenMetadata CVE-2026-26010 describes a leakage of JWTs through calls to /api/v1/ingestionPipelines from the UI, prior to version 1.11.8. Read-only users could obtain tokens used by the ingestion-bot for services such as Glue, Redshift, and Postgres, enabling access to a highly privileged Ingesti...
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
Summary Calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services Glue / Redshift / Postgres Details Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes...
[SECURITY] Fedora 42 Update: migrate-4.19.0-1.fc42
Go database migrations library and program. This package is built with the following databases backends: cassandra cockroachdb mongodb mysql postgres redshift sqlite3 sqlite This package is built with the following source backends: github gitlab go-bindata godoc-vfs gcs iofs pkger s3...
[SECURITY] Fedora 43 Update: migrate-4.19.0-1.fc43
Go database migrations library and program. This package is built with the following databases backends: cassandra cockroachdb mongodb mysql postgres redshift sqlite3 sqlite This package is built with the following source backends: github gitlab go-bindata godoc-vfs gcs iofs pkger s3...
CVE-2025-10702
Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...
EUVD-2025-176760
Malicious code in redshift-run-script-chai-koa npm...
EUVD-2025-176763
Malicious code in redshift-build-geodynamo-hyperion npm...
EUVD-2025-179980
Malicious code in boson-fornax-redshift-andromeda npm...
EUVD-2025-177656
Malicious code in neptune-redshift-semantic-release-xml npm...
EUVD-2025-177794
Malicious code in mocha-eventhoriz-wavefunction-redshift npm...
Malicious code in redshift-build-geodynamo-hyperion (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eb6dba5456ba6db7b6f8b463cbe02f3929d795d4d1027a1cbc0a88a12d75528 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178187
Malicious code in kinetic-redshift-pino-pretty-prettier-plugin-markdown npm...
EUVD-2025-178926
Malicious code in fermiparadox-redshift-rollup-plugin-phoebe npm...
EUVD-2025-179456
Malicious code in css-minimizer-webpack-plugin-vuetify-ichnology-redshift npm...
EUVD-2025-176759
Malicious code in redshift-sagitta-geodynamo-planckscale npm...
EUVD-2025-178151
Malicious code in leda-epigenetics-redshift-geochronology npm...
EUVD-2025-177522
Malicious code in nova-virgo-jasmine-redshift npm...