Improper Authorization

Overview @voltagent/serverless-hono is a Serverless fetch-based runtime provider for VoltAgent using Hono Affected versions of this package are vulnerable to Improper Authorization via the handleGetMemoryConversation function. An attacker can gain unauthorized access to memory conversation data b...

Malicious code in serverless-convention (npm)

The serverless-convention npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

MAL-2026-6434 Malicious code in serverless-convention (npm)

The serverless-convention npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

MAL-2026-6435 Malicious code in serverless-leo (npm)

The serverless-leo npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

Malicious code in serverless-leo (npm)

The serverless-leo npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

org.http4k:http4k-server-apache (3.136.0), org.http4k:http4k-server-jetty (3.136.0) +3 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.136.0)

org.http4k:http4k-core MAVEN version 3.136.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-server-apache 3.136.0 - org.http4k:http4k-server-jetty 3.136.0 - org.http4k:http4k-server-netty...

org.http4k:http4k-server-apache (3.136.0), org.http4k:http4k-server-jetty (3.136.0) +3 more potentially affected by unknown CVE via org.http4k:http4k-core (3.136.0)

org.http4k:http4k-core MAVEN version 3.136.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-server-apache 3.136.0 - org.http4k:http4k-server-jetty 3.136.0 - org.http4k:http4k-server-netty...

org.http4k:http4k-server-apache (3.136.0), org.http4k:http4k-server-jetty (3.136.0) +3 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.136.0)

org.http4k:http4k-core MAVEN version 3.136.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-server-apache 3.136.0 - org.http4k:http4k-server-jetty 3.136.0 - org.http4k:http4k-server-netty...

CVE-2026-50545

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous...

CVE-2026-46614

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an internal-style route — /fission-function/ and /fission-function// — for every Function object,...

PT-2026-48504

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0 Description Fission is an open-source, Kubernetes-native serverless framework used for deploying functions and applications on Kubernetes. A flaw exists where a low-privilege developer with permissions to creat...

PT-2026-48508

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0 Description Fission is an open-source, Kubernetes-native serverless framework used for deploying functions and applications on Kubernetes. The Container Executor path allows a tenant to directly supply...

PT-2026-48503

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0 Description Fission is an open-source, Kubernetes-native serverless framework used for deploying functions and applications on Kubernetes. The buildermgr controller processes Package Custom Resource Definitions...

PT-2026-48505

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0 Description An issue exists in the Fission serverless framework where the admission webhook fails to validate the namespace for the PackageRef.Namespace reference type. While Secret and ConfigMap reference type...

serverless-llm-store (0.5.0), turbo-alignment (0.0.2) potentially affected by CVE-2026-5241 via transformers (4.42.0)

transformers PYPI version 4.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - serverless-llm-store 0.5.0 - turbo-alignment 0.0.2 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...

serverless-llm-store (0.5.0), turbo-alignment (0.0.2) potentially affected by CVE-2026-5241 via transformers (4.42.0)

transformers PYPI version 4.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - serverless-llm-store 0.5.0 - turbo-alignment 0.0.2 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-2290...

serverless-llm-store (0.5.0), turbo-alignment (0.0.2) potentially affected by CVE-2026-4372 via transformers (4.42.0)

transformers PYPI version 4.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - serverless-llm-store 0.5.0 - turbo-alignment 0.0.2 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

serverless-llm-store (0.5.0), turbo-alignment (0.0.2) potentially affected by CVE-2026-4372 via transformers (4.42.0)

transformers PYPI version 4.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - serverless-llm-store 0.5.0 - turbo-alignment 0.0.2 Source cves: CVE-2026-4372 Source advisory: OSV:PYSEC-2026-2289...

Introducing Runtime Threat Detection for Google Cloud Run

Wiz Runtime Sensor support for Google Cloud Run Containers is now generally available, giving teams real-time threat detection and response for their serverless container workloads...

anjiayi-elf (>=1.0.0, <=1.0.9), anjiayi-exp (>=1.0.0, <=1.2.6) +5 more potentially affected by unknown CVE via lutils-merge (>=0.1.4, <=0.2.6)

lutils-merge NPM version =0.1.4, =1.0.0, =1.0.0, =1.0.0, =0.0.1-alpha, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: MEND:WS-2019-0127...