io.jenkins.plugins:aws-lambda-cloud (>=0.3, <=0.4), org.jenkins-ci.main:jenkins-test-harness (1.635) +2 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.635)

org.jenkins-ci.main:jenkins-core MAVEN version 1.635 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.jenkins.plugins:aws-lambda-cloud =0.3, =0.4 - org.jenkins-ci.main:jenkins-test-harness 1.635...

com.xti.jenkins.plugins:aws-lambda-jenkins-plugin (0.0.1), org.jenkins-ci.main:jenkins-test-harness (1.599) +7 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.599)

org.jenkins-ci.main:jenkins-core MAVEN version 1.599 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.xti.jenkins.plugins:aws-lambda-jenkins-plugin 0.0.1 -...

Ubuntu: Security Advisory (USN-8013-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8015-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

langchain-anthropic (>=0.2.0.dev0, <=0.2.0.dev1), langchain-aws (0.2.0.dev1) +12 more potentially affected by CVE-2026-26013 via langchain-core (0.4.0.dev0)

langchain-core PYPI version 0.4.0.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langchain-anthropic =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.3.0.dev0, =0.1.0.dev0, =0.1.0.dev1 Source cves:...

CVE-2026-25492

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

atlassian-jwt-auth (8.0.1), authx (>=0.0.3, <=0.0.5) +28 more potentially affected by CVE-2026-26007 via cryptography (3.1.1)

cryptography PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 8.0.1 - authx =0.0.3, =0.9.1, =1.0.0, =0.8.2rc2, =3.20.0, =0.1.0a1, =0.0.1, =0.0.7, =0.0.5, =0.1.0a1, =0.1.0a4 and mo...

20220429-pdfminer-jameslp310 (0.0.2), adapta (>=2.0.0, <=3.3.6) +347 more potentially affected by CVE-2026-26007 via cryptography (36.0.2)

cryptography PYPI version 36.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - 20220429-pdfminer-jameslp310 0.0.2 - adapta =2.0.0, =0.0.53, =2022.7.7b1, =0.3.11, =1.4.0.dev7, =3.7.1b1, =1.6.1, =14.0.0, =0.0.3,...

apputils-config (>=2.0.2.dev19, <=2.0.2.dev20), aws-gate (>=0.9.3, <=0.11.0) +43 more potentially affected by CVE-2026-26007 via cryptography (3.3.1)

cryptography PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - apputils-config =2.0.2.dev19, =0.9.3, =0.1.1, =1.1.0, =1.2.3, =3.26.0, =0.1.1, =21.1.0, =0.1.0, =0.0.1, =0.2.0, =0.2.8 and more Source...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: kind, aws-network-policy-agent, kubernetes-csi-external-attacher, crossplane-provider-keycloak, libnvidia-container, prometheus-alertmanager, certificate-transparency, cni-plugins, octo-sts, influx, syft, helm, metrics-agent, victoriametrics, pulumi-language-java,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: kind, aws-network-policy-agent, kubernetes-csi-external-attacher, crossplane-provider-keycloak, libnvidia-container, prometheus-alertmanager, certificate-transparency, octo-sts, influx, syft, helm, metrics-agent, victoriametrics, pulumi-language-java, kubeflow,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: kind, aws-network-policy-agent, kubernetes-csi-external-attacher, crossplane-provider-keycloak, libnvidia-container, prometheus-alertmanager, certificate-transparency, cni-plugins, octo-sts, influx, syft, helm, metrics-agent, victoriametrics, pulumi-language-java,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, cert-manager-csi-driver-fips, podman-fips, terraform-provider-time, k8ssandra-client-fips, sftpgo-plugin-eventsearch, prometheus-podman-exporter-fips, thanos-receive-controller-fips, prometheus-process-exporter-fips, protoc-gen-go, age-fips,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, cert-manager-csi-driver-fips, podman-fips, terraform-provider-time, k8ssandra-client-fips, sftpgo-plugin-eventsearch, prometheus-podman-exporter-fips, thanos-receive-controller-fips, prometheus-process-exporter-fips, vault-csi-provider-fips,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, cert-manager-csi-driver-fips, podman-fips, terraform-provider-time, k8ssandra-client-fips, sftpgo-plugin-eventsearch, prometheus-podman-exporter-fips, thanos-receive-controller-fips, prometheus-process-exporter-fips, protoc-gen-go, age-fips,...

Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Summary - The saveimagesAsset graphql mutation allows a user to give a url of an image to download. Url must use a domain, not a raw IP. - Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 special AWS metadata IP - Attacker invokes saveimagesAsset with url...

CVE-2026-25492 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

CVE-2026-25492: Server-Side Request Forgery (SSRF)

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

PT-2026-7142

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save images Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

Ubuntu: Security Advisory (USN-8015-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...