MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:2643-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2643-1 advisory. This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385:...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: zarf, aactl, spire-server-fips, tflint, tekton-chains-fips, falcoctl, goreleaser, kubescape-server-fips, crossplane-fips, cloudbeat, trivy-operator, zarf-fips, teleport, tekton-chains, policy-controller-fips, tbot, docker-fips, falcoctl-fips, kubescape-server,...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: zarf, aactl, spire-server-fips, tflint, tekton-chains-fips, falcoctl, goreleaser, kubescape-server-fips, crossplane-fips, cloudbeat, trivy-operator, zarf-fips, teleport, tekton-chains, policy-controller-fips, tbot, docker-fips, falcoctl-fips, kubescape-server,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, omnictl-multiarch, chisel, mattermost, nemo, frankenphp-8.3, prometheus, gatekeeper, kaf, grafana, chisel-fips, elastic-agent-fips, kuma, kots, harbor, loki, flux-source-controller-fips, mattermost-fips, gitea-fips, gitlab-kas,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2, grype-fips, chisel, packer-fips, crossplane-provider-aws-guardduty-fips, crossplane-provider-aws-s3, amazon-ssm-agent, crossplane-provider-aws-mediapackage, cosign, crossplane-provider-keycloak, step-kms-plugin-fips, frankenphp-8.3,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gomplate, atlantis, guac, buildah, k9s, openbao, crossplane-provider-azure-managedidentity, scorecard, hcloud, opentofu, age, kaf, pulumi-kubernetes-operator, cilium, pulumi, rancher, vault-benchmark, buildkitd, apko, terraform-provider-azurerm,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, argocd-image-updater, kubescape, spire-server, gitlab-kas, kubernetes, chisel, flux-source-controller, flux, istio, k9s, aactl, external-dns, snyk-cli, zarf, telegraf, kubernetes-dashboard, mattermost, minio, knative-serving, fscrypt,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: gomplate, guac, buildah, k9s, openbao, scorecard, opentofu, kaf, pulumi-kubernetes-operator, cilium, pulumi, rancher, apko, syft, caddy, flux-source-controller, telegraf, chezmoi, fscrypt, cilium-cli, pulumi-language-yaml, step, step-kms-plugin, containerd, helm,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, spire-server, gitlab-kas, kubernetes, flux, buildah, istio, aactl, external-dns, snyk-cli, podman, telegraf, kubernetes-dashboard, mattermost, minio, knative-serving, fscrypt, cilium-cli, kine, cloud-provider-aws, containerd, helm, kots, loki...

Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues CVE-2022-1996: CORS bypass bsc1200528. CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. CVE-2025-47910: net/http:...

SUSE-SU-2026:2643-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. - CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. - CVE-2025-47910: net/http:...

GO-2026-5601 AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

MAL-2026-6486 Malicious code in unsafe-malicious-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3579cb796e48f446b07e2dbbce2e301d1a3e87d8a9a35ed1dbe825fc53f29da9 On npm install, the package's postinstall lifecycle script scripts/postinstall.js reads the installer's AWS credentials file at /.aws/credentials and...

MAL-2026-6432 Malicious code in rstreams-metrics (npm)

The rstreams-metrics npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6418 Malicious code in leo-aws (npm)

The leo-aws npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6422 Malicious code in leo-config (npm)

The leo-config npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

CVE-2026-57294

A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...

CVE-2026-57295

A cross-site request forgery CSRF vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...

CVE-2026-57295

A cross-site request forgery CSRF vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...