Malicious code in bb-twl-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:3473-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3473-1 advisory. This update for aws-iam-authenticator fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266651. Changes for aws-iam-authenticator: Update golang.org/x/net to v0.57.0. Pat...

SUSE-SU-2026:3473-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266651. Changes for aws-iam-authenticator: - Update golang.org/x/net to v0.57.0...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:2643-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2643-1 advisory. This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385:...

Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues CVE-2022-1996: CORS bypass bsc1200528. CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. CVE-2025-47910: net/http:...

SUSE-SU-2026:2643-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. - CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. - CVE-2025-47910: net/http:...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: gitsign, crossplane-provider-aws-iam, hydra-fips, prometheus-alertmanager, docker-machine-driver-harvester, crossplane-provider-aws-osis-fips, eks-node-monitoring-agent, thanos, kubernetes-csi-livenessprobe, redpanda-operator, aws-ebs-csi-driver-fips, terraform-fips,...

CVE-2025-1969

Improper request input validation in Temporary Elevated Access Management TEAM for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process...

EUVD-2021-1705

Malware in sbrugna...

EUVD-2019-2220

Malware in sbrugna...

EUVD-2022-6388

Malicious code in bioql PyPI...

EUVD-2025-19636

Malicious code in bioql PyPI...

EUVD-2025-7453

Malicious code in bioql PyPI...

CVE-2025-34062 OneLogin AD Connector API Credential and Signing Key Exposure

An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directorytoken—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext respon...

AWS Default IAM Roles Found to Enable Lateral Movement and Cross-Service Exploitation

Cybersecurity researchers have discovered risky default identity and access management IAM roles impacting Amazon Web Services that could open the door for attackers to escalate privileges, manipulate other AWS services, and, in some cases, even fully compromise AWS accounts. "These roles, often...

Overly Permissive Authorization

aws-cdk-lib is vulnerable to Overly Permissive Authorization. The vulnerability is due to the CDK Construct Library automatically generating an overly permissive AWS IAM trust policy, which allows any user with unrestricted sts:AssumeRole permissions to assume the role...

CVE-2025-1969

Improper request input validation in Temporary Elevated Access Management TEAM for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process...

CVE-2025-1969 Request approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

Improper request input validation in Temporary Elevated Access Management TEAM for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process...

CVE-2025-1969

CVE-2025-1969 involves AWS IAM Identity Center’s Temporary Elevated Access Management (TEAM). The issue is improper input validation that lets a user modify a valid request and spoof an approval in TEAM. Affected component: TEAM (Temporary Elevated Access Management) within AWS IAM Identity Cente...