GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, cloudbeat, rancher-helm, helm-mapkubeapis, kubescape-server-fips, linkerd2-fips, envoy-gateway-fips, eksctl, helm-exporter, crossplane-fips, kots, chartmuseum-fips, ocm-cli-fips, kyverno, vcluster-fips, kgateway-fips, oras, falcoctl-fips,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: argo-cd, helm-operator, vcluster, tigera-operator, kube-arangodb, trivy-operator, kubescape, rancher-agent, teleport, helm-push, manifest-tool, consul-k8s, helm, kyverno-notation-aws, linkerd2, helm-mapkubeapis, steampipe, kots, tw, cilium-cli, rancher-helm,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: argo-cd, helm-operator, vcluster, tigera-operator, kube-arangodb, trivy-operator, kubescape, rancher-agent, teleport, helm-push, manifest-tool, consul-k8s, helm, kyverno-notation-aws, linkerd2, helm-mapkubeapis, steampipe, kots, tw, cilium-cli, rancher-helm,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: argo-cd, helm-operator, vcluster, tigera-operator, kube-arangodb, trivy-operator, kubescape, opentofu, rancher-agent, helm-push, manifest-tool, teleport, consul-k8s, helm, kyverno-notation-aws, k8ssandra-client, linkerd2, helm-mapkubeapis, steampipe, kots, tw,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: argo-cd, helm-operator, vcluster, tigera-operator, kube-arangodb, trivy-operator, kubescape, opentofu, rancher-agent, helm-push, manifest-tool, teleport, consul-k8s, helm, kyverno-notation-aws, k8ssandra-client, linkerd2, helm-mapkubeapis, steampipe, kots, tw,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: argo-cd, helm-operator, vcluster, tigera-operator, kube-arangodb, trivy-operator, kubescape, opentofu, rancher-agent, helm-push, manifest-tool, teleport, consul-k8s, helm, kyverno-notation-aws, k8ssandra-client, linkerd2, helm-mapkubeapis, steampipe, kots, tw,...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: argo-cd, helm-operator, vcluster, tigera-operator, kube-arangodb, trivy-operator, kubescape, opentofu, rancher-agent, helm-push, manifest-tool, teleport, consul-k8s, helm, kyverno-notation-aws, k8ssandra-client, linkerd2, helm-mapkubeapis, steampipe, kots, tw,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: argo-cd, helm-operator, vcluster, tigera-operator, kube-arangodb, trivy-operator, kubescape, opentofu, rancher-agent, helm-push, manifest-tool, teleport, consul-k8s, helm, kyverno-notation-aws, k8ssandra-client, linkerd2, helm-mapkubeapis, steampipe, kots, tw,...

CVE-2026-54430

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

AZL-91679 CVE-2026-54430 affecting package liboauth 1.0.3-15

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

UBUNTU-CVE-2026-54430

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

CVE-2026-54430 Server-Site Request Forgery in liboauth2

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

Malicious code in @marketfront/header (npm)

The @marketfront/header package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

CVE-2026-13760 OS Command Injection in aws-cdk-lib Docker Bundling

OS command injection in the NodejsFunction Docker bundling pipeline OsCommand helper in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected...

CVE-2026-13760 OS Command Injection in aws-cdk-lib Docker Bundling

OS command injection in the NodejsFunction Docker bundling pipeline OsCommand helper in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected...

CVE-2026-13760

OS command injection in the NodejsFunction Docker bundling pipeline OsCommand helper in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected...

Malicious code in date-fns-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4694a079d83e33dcee7f87140c41737009d9f0b19f351c23f2ae3dbce9a47a51 [email protected] presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs automatically on npm install. T...

CVE-2026-13760: Improper Neutralization of Special Elements used in an OS Command

OS command injection in the NodejsFunction Docker bundling pipeline OsCommand helper in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected...

CVE-2026-14265: Deserialization of Untrusted Data

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a...

CVE-2026-13769: Incorrect Permission Assignment for Critical Resource

Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain CLI subcommands...