EUVD-2026-8646

Budibase: Remote Code Execution via Unsafe eval in View Filter Map Function Budibase Cloud...

GHSA-XH87-MX6M-69F3 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Summary When using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For header. Because AWS ALB appends the real client IP address to the end of the X-Forwarded-For header, the first...

User Impersonation

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to User Impersonation via the getConnInfo function in the adapter/aws-lambda/conninfo.ts‎ file. An attacker can gain unauthorized access to resources protected by IP-based...

CVE-2026-27700

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter "hono/aws-lambda" behind an Application Load Balancer ALB, the "getConnInfo" function incorrectly selected the first value from the...

CVE-2026-27700: Insufficient Verification of Data Authenticity

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1081 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: SNYK:JS-FASTXMLPARSER-15324289...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1081 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: OSV:GHSA-M7JM-9GC2-MPF2...

com.xti.jenkins.plugins:aws-lambda-jenkins-plugin (0.0.1), org.jenkins-ci.main:jenkins-test-harness (1.599) +7 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.599)

org.jenkins-ci.main:jenkins-core MAVEN version 1.599 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.xti.jenkins.plugins:aws-lambda-jenkins-plugin 0.0.1 -...

com.amazonaws:aws-codepipeline (>=0.9, <=0.45), com.tinfoilsecurity.plugins:tinfoil-scan (1.4) +5 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.479)

org.jenkins-ci.main:jenkins-core MAVEN version 1.479 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.amazonaws:aws-codepipeline =0.9, =0.45 - com.tinfoilsecurity.plugins:tinfoil-scan 1.4 -...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.5, <=0.5.1), com.piketec.jenkins.plugins:piketec-tpt (>=6.4, <=8.8) +36 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.625.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.625.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.5, =6.4, =2.4.3, =2.4.3,...

Ubuntu: Security Advisory (USN-8013-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8015-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-25492

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

atlassian-jwt-auth (8.0.1), authx (>=0.0.3, <=0.0.5) +28 more potentially affected by CVE-2026-26007 via cryptography (3.1.1)

cryptography PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 8.0.1 - authx =0.0.3, =0.9.1, =1.0.0, =0.8.2rc2, =3.20.0, =0.1.0a1, =0.0.1, =0.0.7, =0.0.5, =0.1.0a1, =0.1.0a4 and mo...

20220429-pdfminer-jameslp310 (0.0.2), adapta (>=2.0.0, <=3.3.6) +350 more potentially affected by CVE-2026-26007 via cryptography (36.0.2)

cryptography PYPI version 36.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - 20220429-pdfminer-jameslp310 0.0.2 - adapta =2.0.0, =0.0.53, =2022.7.7b1, =0.3.11, =1.4.0.dev7, =3.7.1b1, =1.6.1, =14.0.0, =0.0.3,...

apputils-config (>=2.0.2.dev19, <=2.0.2.dev20), aws-gate (>=0.9.3, <=0.11.0) +43 more potentially affected by CVE-2026-26007 via cryptography (3.3.1)

cryptography PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - apputils-config =2.0.2.dev19, =0.9.3, =0.1.1, =1.1.0, =1.2.3, =3.26.0, =0.1.1, =21.1.0, =0.1.0, =0.0.1, =0.2.0, =0.2.8 and more Source...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: vault-secrets-webhook, docker-credential-acr-env, prometheus-alertmanager, openfga, paranoia, aws-eks-pod-identity-agent, azcopy, aws-flb-cloudwatch, vertical-pod-autoscaler, tetragon, polaris, cis-operator, nodetaint, nsc, cass-operator, opentelemetry-operator, kine...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: vault-secrets-webhook, docker-credential-acr-env, prometheus-alertmanager, kratos, openfga, paranoia, aws-eks-pod-identity-agent, azcopy, aws-flb-cloudwatch, vertical-pod-autoscaler, tetragon, polaris, cis-operator, nodetaint, nsc, cass-operator,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: vault-secrets-webhook, docker-credential-acr-env, prometheus-alertmanager, kratos, openfga, paranoia, aws-eks-pod-identity-agent, azcopy, aws-flb-cloudwatch, vertical-pod-autoscaler, tetragon, polaris, cis-operator, nodetaint, nsc, cass-operator,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: karpenter-fips, kubernetes-dashboard-auth-fips, cephcsi, memcached-exporter, gogatekeeper, helm-mapkubeapis, licenseclassifier, minify, nsc-fips, terragrunt, fulcio, grype-fips, wuzz, grafana-mimir, teleport-operator-fips, skaffold, doppler-kubernetes-operator,...