GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-alertsmanagement, crossplane-provider-azure-orbital, crossplane-provider-azure-powerbidedicated, crossplane-provider-azure-servicebus, crossplane-provider-azure-relay, grafana, nuclei, goreleaser, x509-certificate-exporter-fips,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: kots, fulcio, crossplane-provider-azure-storage, crossplane-provider-azure-orbital, neuvector-sigstore-interface-fips, knative-eventing-fips, opentelemetry-collector, ksops, crossplane-provider-azure-servicelinker, gitea, terragrunt-fips, nemo,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, ksops, terragrunt-fips, flux-image-automation-controller, crossplane-provider-aws-ecs, helm, crossplane-provider-aws-bedrockagent-fips, knative-serving-fips, terragrunt, crossplane-provider-aws-kinesis-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, ksops, terragrunt-fips, flux-image-automation-controller, crossplane-provider-aws-ecs, helm, crossplane-provider-aws-bedrockagent-fips, knative-serving-fips, terragrunt, crossplane-provider-aws-kinesis-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: kots, fulcio, crossplane-provider-azure-storage, crossplane-provider-azure-orbital, neuvector-sigstore-interface-fips, knative-eventing-fips, opentelemetry-collector, ksops, crossplane-provider-azure-servicelinker, gitea, terragrunt-fips, nemo,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux-notification-controller, docker-cli-buildx, fulcio, cilium-cli, cloud-provider-aws, ko, sops, kaf, pulumi-language-dotnet, cluster-api-azure-controller, k8sgpt, age, zarf, openbao, terraform-provider-tls, gitea, gitlab-kas, ksops,...

CVE-2026-55412

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only...

CVE-2026-55412

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only...

CVE-2026-55412 ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only...

EUVD-2026-39469

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only...

CVE-2026-55412

ToolJet (open-source platform) Vulnerability: SSRF in the RestAPI data source component allows authenticated users to induce server-side HTTP requests that bypass its private IP filter via DNS trickery (169.254.169.254.nip.io), potentially stealing Azure managed identity tokens for the AKS produc...

GHSA-HV8M-JJ95-WG3X vulnerabilities

Vulnerabilities for packages: azure-functions-extension-bundles...

CVE-2026-48109 vulnerabilities

Vulnerabilities for packages: azure-functions-extension-bundles...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: kots, redpanda-operator, neuvector-sigstore-interface-fips, google-cloud-otel-ops-collector, kiali-fips, ksops, tetragon-fips, flux-image-reflector-controller, cass-operator-fips-no-pvc-delete, dapr-fips, flux-image-automation-controller, crossplane-provider-aws-ecs,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: kots, redpanda-operator, neuvector-sigstore-interface-fips, google-cloud-otel-ops-collector, kiali-fips, ksops, tetragon-fips, flux-image-reflector-controller, cass-operator-fips-no-pvc-delete, dapr-fips, flux-image-automation-controller, crossplane-provider-aws-ecs,...

CVE-2026-56425 MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection

The Azure Active Directory AAD authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session identifier sessionid as the OAuth state...

CVE-2026-56425

CVE-2026-56425 affects the AAD authentication plugin for MISP (OAuth 2.0). The vulnerability stems from using session_id() as the OAuth state parameter, lack of session rotation after login, no dedicated nonce for the state, and not enforcing HTTPS for the redirect URI. Additional issue: OAuth er...

Azure File Sync Agent V22.4 - June 2026

Azure File Sync Agent V22.4 - June 2026 This article describes the improvements and issues that are fixed in the Azure File Sync Agent v22.4 release that is dated June 2026. Additionally, this article contains installation instructions for this release. Improvements and issues that are fixed Serv...

CVE-2026-48584

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network...

CVE-2026-45480

Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network...