GO-2026-5746 vulnerabilities

Vulnerabilities for packages: kots, trivy-operator, grafana, envoy-gateway, opentelemetry-operator, kpt, docker-credential-gcr, undock, buildah, grafana-alloy, rancher-machine, aws-otel-collector, nuclei, nerdctl, ko, amazon-cloudwatch-agent-operator, spire-server, rancher-agent, skopeo,...

GO-2026-5710 vulnerabilities

Vulnerabilities for packages: tempo, keda, grafana, trillian, prometheus-operator, prometheus-pushgateway, minio-operator, karma, certificate-transparency, metrics-server, aws-otel-collector, amazon-cloudwatch-agent-operator, minio, prometheus, jaeger, mc, istio, cloud-sql-proxy, datadog-agent,...

GO-2026-4979 vulnerabilities

Vulnerabilities for packages: kots, act, kubeflow, argo-events, juicefs, slsa-verifier, prometheus-pushgateway, undock, kubernetes, minio-operator, cert-exporter, hivemind, teleport, scorecard, buildah, xeol, sftpgo, cloud-provider-aws, terraform-provider-acme, docker, nuclei, runc,...

GO-2026-4980 vulnerabilities

Vulnerabilities for packages: kots, argo-events, juicefs, slsa-verifier, prometheus-pushgateway, undock, kubernetes, teleport, scorecard, buildah, xeol, sftpgo, terraform-provider-acme, nuclei, runc, step, go, prometheus, argo-cd, cloudnative-pg, cert-manager-csi-driver, knative-eventing,...

GO-2026-4337 vulnerabilities

Vulnerabilities for packages: ghaudit, opentelemetry-operator, minio-operator, fuse-overlayfs-snapshotter, kwok, polaris, sftpgo, terraform-provider-acme, nri-redis, git-sync, knative-client, kor, witness, dkron, q, step-kms-plugin, mcp-grafana, kube-vip, rancher-system-upgrade-controller,...

Malicious code in check-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723c3dbef875102d9d461c655737b930ea9f58f2a5555bd254d954d7003eacf5 [email protected] is an otherwise empty package no author, no description, no meaningful code whose only effect on install is to pull a dependency...

MAL-2026-13976 Malicious code in check-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723c3dbef875102d9d461c655737b930ea9f58f2a5555bd254d954d7003eacf5 [email protected] is an otherwise empty package no author, no description, no meaningful code whose only effect on install is to pull a dependency...

Malicious code in resolve-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c [email protected] is a stub package index exports an empty object whose package.json declares its only dependency ltidisafe as a direct HTTPS...

MAL-2026-13987 Malicious code in resolve-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c [email protected] is a stub package index exports an empty object whose package.json declares its only dependency ltidisafe as a direct HTTPS...

Vaultwarden /events/collect cross-organization event injection

Vaultwarden /events/collect Cross-Organization Event Injection Vulnerability Overview The Bitwarden protocol's event-reporting endpoint POST /events/collect receives user operation events submitted by clients entry viewing, password-field copying, editing, etc., and the server writes them into...

Vaultwarden unconditionally trusts the X-Real-IP header, enabling rate-limit bypass and audit IP spoofing

Vaultwarden Unconditional Trust in the X-Real-IP Request Header Leading to Rate-Limit Bypass and Audit IP Spoofing Overview Vaultwarden supports reading the client IP from a configurable HTTP request header IPHEADER, default X-Real-IP for rate limiting of login/2FA and the admin panel, as well as...

Malicious Package

Overview check-audit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview resolve-audit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-19182

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLEREST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLEREADONLY, to modify alarm state despite the...

inspect_petri v3.1.0

Inspect Petri Welcome to Inspect Petri, an auditing agent that enables automated monitoring and interaction with language models to detect potential alignment issues, reward hacking, and other concerning behaviors. Petri helps you rapidly test concrete alignment hypotheses end‑to‑end. It: Generat...

PT-2026-73166

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

The Ack3 H1 2026 DeFi Incident Dataset: Audit Scope across 135 Security Incidents

Smart-contract audits cover defined artifacts at a specific time, but the label audited is often treated as project-wide assurance. We analyze audit history and incident-path scope across 135 DeFi security incidents using the H1 2026 DeFi Incident Dataset published by cybersecurity company ack3...

PT-2026-71387

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLE REST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLE READONLY, to modify alarm state despite the...

Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation

Security evaluations of tool-using agents often equate stored labels with behavioral facts. We audit a preserved campaign by tracing 10,200 execution rows to 180 model-bound requests, 45 semantic requests, and 15 observable stimuli. Two schema treatments were delivered, but the planned external...

CVE-2026-19182: Incorrect Authorization

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLEREST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLEREADONLY, to modify alarm state despite the...