MAL-2026-5135 Malicious code in @redhat-cloud-services/frontend-components-advisor-components (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: chartmuseum, sftpgo-plugin-auth, wire-go, fuse-overlayfs-snapshotter, karpenter, kuberlr, cilium, aws-sigv4-proxy, kargo, local-static-provisioner, redka, crossplane-provider-keycloak, seaweedfs, kpt, azure-service-operator, libnvidia-container,...

CVE-2021-3864 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu-melange, linux-qemu...

GHSA-9682-F2FR-3H46 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu-melange, linux-qemu...

GHSA-R4VM-3MC7-PRGX vulnerabilities

Vulnerabilities for packages: linux-azure, linux-gcp, linux-aws...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: dive, authservice, openbao-fips, cortex, kargo, nri-kubernetes, argo-events-fips, vault-csi-provider-fips, cloudflared, packer-fips, postgres-operator, smarter-device-manager-fips, weaviate, cluster-autoscaler, tigera-operator, x509-certificate-exporter-fips,...