CVE-2026-93318: Improper Validation of Integrity Check Value

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

Malicious code in bq-build-probe-vrp-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65 setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the G...

MAL-2026-11573 Malicious code in @nebula.js/sn-distributionplot (npm)

npm/@nebula.js/sn-distributionplot is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @qlik/embed-react (npm)

npm/@qlik/embed-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11598 Malicious code in @onereach/expression-components (npm)

npm/@onereach/expression-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11702 Malicious code in @or-sdk/invitations (npm)

npm/@or-sdk/invitations is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11737 Malicious code in @or-sdk/views (npm)

npm/@or-sdk/views is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

Malicious code in @onereach/idw-init-account-resources (npm)

npm/@onereach/idw-init-account-resources is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanize...

MAL-2026-11633 Malicious code in @onereach/si-collapsible-group (npm)

npm/@onereach/si-collapsible-group is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-66018

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

EUVD-2026-49573

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

CVE-2026-66018

CVE-2026-66018 affects JFrog Artifactory: Build readers can access another repository's environment properties by selecting a readable repository parameter when retrieving environment properties for a protected build, exposing build environment secrets. Impact is confidentiality only (no integrit...

CVE-2026-66018

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

Buildkit credentials inlined to Git URLs could end up in provenance attestation

When the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1 Invoking build directly from a URL...

PT-2023-20454

Name of the Vulnerable Software and Affected Versions BuildKit versions v0.11.0 through v0.11.3 Description The issue arises when a build request contains a Git URL with credentials and creates a provenance attestation describing the build. These credentials could be visible from the provenance...