@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1081 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: SNYK:JS-FASTXMLPARSER-15324289...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1081 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: OSV:GHSA-M7JM-9GC2-MPF2...

Ubuntu: Security Advisory (USN-8013-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8015-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-25492

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: metrics-server, custom-pod-autoscaler-operator, ipfs-cluster, rekor, stakater-reloader, argo-events, crossplane-provider-aws-memorydb, grafana, kafkaexporter, doppler-kubernetes-operator, caddy, mongo-tools, kubernetes-csi-driver-nfs, cilium-cli, authservice,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: metrics-server, custom-pod-autoscaler-operator, ipfs-cluster, rekor, stakater-reloader, argo-events, crossplane-provider-aws-memorydb, grafana, kafkaexporter, doppler-kubernetes-operator, caddy, mongo-tools, kubernetes-csi-driver-nfs, cilium-cli, authservice,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: metrics-server, custom-pod-autoscaler-operator, ipfs-cluster, rekor, stakater-reloader, argo-events, crossplane-provider-aws-memorydb, grafana, kafkaexporter, doppler-kubernetes-operator, caddy, mongo-tools, kubernetes-csi-driver-nfs, cilium-cli, authservice,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit-fips, aws-load-balancer-controller, podman-fips, rancher-webhook-fips, witness, ytt, pgtimetable, telegraf, fulcio, kyverno, nuclei, backup-restore-operator-fips, cert-manager-csi-driver, pvc-autoresizer-fips, malcontent, neuvector-dbgen,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: podman-fips, aws-load-balancer-controller, rancher-webhook-fips, witness, ytt, pgtimetable, telegraf, fulcio, kyverno, nuclei, backup-restore-operator-fips, cert-manager-csi-driver, pvc-autoresizer-fips, malcontent, neuvector-dbgen, kube-state-metrics,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit-fips, aws-load-balancer-controller, podman-fips, rancher-webhook-fips, witness, ytt, pgtimetable, telegraf, fulcio, kyverno, nuclei, backup-restore-operator-fips, cert-manager-csi-driver, pvc-autoresizer-fips, malcontent, neuvector-dbgen,...

Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Summary - The saveimagesAsset graphql mutation allows a user to give a url of an image to download. Url must use a domain, not a raw IP. - Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 special AWS metadata IP - Attacker invokes saveimagesAsset with url...

CVE-2026-25492 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

CVE-2026-25492: Server-Side Request Forgery (SSRF)

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

Ubuntu: Security Advisory (USN-8015-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-7142

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save images Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

Ubuntu: Security Advisory (USN-8013-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8014-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Medium: aws-nitro-enclaves-cli

Issue Overview: openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Affected Packages: aws-nitro-enclaves-cli Issue Correction: Run dnf update aws-nitro-enclaves-cli --releasever 2023.10.20260202 or dnf update --advisory ALAS2023-2026-1371 --releasever 2023.10.202602...

Medium: aws-nitro-enclaves-cli

Issue Overview: openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Affected Packages: aws-nitro-enclaves-cli Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ sectio...