PT-2026-61855

Name of the Vulnerable Software and Affected Versions Apache Fory versions prior to 1.4.0 Description An issue exists involving the deserialization of untrusted data, which may allow class-registration checks to be bypassed during Java lambda deserialization. This specifically affects the lambda...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the validateOpaqueToken process. An attacker can gain unauthorized access to protected tools and underlying data sources by submitting an OAuth 2.0 introspection response that omits the mandatory active...

Insufficient Technical Documentation

Overview @hulumi/baseline is a Hardened Pulumi baseline components for AWS and GitHub — SecureBucket, AccountFoundation, AWS organization guardrails, secure primitives, detection foundations, SecureRepository, OrgFoundation. SLSA Build L3 attestation on every release. Affected versions of this...

GHSA-RHGJ-6G2C-FRMM @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name

Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-693 Protection Mechanism Failure Summary Pulumi gives every cloud resource a structured URN that includes the resource's type chain hulumi:baseline:aws:SecureBucket$aws:s3/bucketV2:BucketV2 and the logical name the develope...

Missing Authorization

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Improper Verification of Cryptographic Signature

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Cross-site Request Forgery (CSRF)

Overview omni-cortex is a Give Claude Code a perfect memory - auto-logs everything, searches smartly, and gets smarter over time Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. The CORS configuration allows wildcard HTTP methods and headers, leading to malicio...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution via a crafted URL when the verifyurl option is disabled. This happens due to mishandling of the ImageMagick convert utility. NOTE: This vulnerability has also been identified as: CVE-2021-33564 Remediation Upgra...