Malicious code in matlab-azure-devops-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b The package's preinstall script node index.js auto-executes on npm install and collects host identifiers os.hostname, os.userInfo.username, home...

ROOT-APP-PYPI-CVE-2026-21226 CVE-2026-21226 in azure-core - Patched by Root

Root has patched CVE-2026-21226 in the azure-core package for Root:PyPI. Multiple fixed versions available...

MAL-2026-11885 Malicious code in @servicetitan/lazy-module (npm)

npm/@servicetitan/lazy-module is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1781139209 TuxCare security update for @azure (8 CVEs)

TuxCare rebuilt 4 @azure packages to address 8 CVEs. Fixed in 4.0.1-tuxcare.1...

MAL-2026-11558 Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

OPENSUSE-SU-2026:11444-1 azure-storage-azcopy-10.32.6-1.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.6-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-66803

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-66803

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

EUVD-2026-51302

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-66803

CVE-2026-66803 affects Azure Cosmos DB and is described as improper access control that allows an unauthorized attacker to execute code over a network. The connected records corroborate this as a remote code execution vulnerability, with a CVSSv3.1 base score of 10.0 (CRITICAL) and network attack...

SUSE CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

SUSE CVE-2026-45796

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...

SUSE CVE-2026-46354

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature...

Azure Cosmos DB Remote Code Execution Vulnerability

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database

A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz , which codenamed the chain CosmosEscape , said the exploit chain began with a...

CLEANSTART-2026-BF59911 Security fixes in az 2.83.0-r2

Package az version 2.83.0-r2 fixes 4 vulnerabilities: CVE-2026-48524, CVE-2026-48522, CVE-2026-48525, CVE-2026-48526...

CLEANSTART-2026-RW79431 Security fixes in velero-plugin-for-microsoft-azure-fips 1.14.0-r1

Package velero-plugin-for-microsoft-azure-fips version 1.14.0-r1 fixes 9 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-32283, CVE-2026-27140...