GO-2024-2456 vulnerabilities

Vulnerabilities for packages: nuclei, gitsign, go-licenses, pulumi-kubernetes-operator, gitness, goreleaser, bom, scorecard, src-fingerprint...

GO-2025-4240 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, rancher-agent, argo-cd, argocd-image-updater, kapp, emissary, aws-efs-csi-driver, mesosphere-vsphere-csi, docker-machine-driver-harvester, local-static-provisioner, blob-csi, rancher-system-agent, calico, kubernetes, kubernetes-csi-driver-hostpath,...

GO-2026-5004 vulnerabilities

Vulnerabilities for packages: spire-server, seaweedfs, splunk-otel-collector, sftpgo, cloudnative-pg, openfga, gitaly, amass, opentelemetry-collector-contrib, hydra, sftpgo-plugin-eventsearch, bento, step-ca, certificate-transparency, cerbos, sqlexporter, envoy-gateway, kube-bench, cloudprober,...

GO-2026-5547 vulnerabilities

Vulnerabilities for packages: spire-server, docker, aactl, gitsign, falcoctl, zarf, vexctl, goreleaser, kyverno, rekor, ko, kubescape, crossplane, zot, gitlab-runner, trivy-operator, gh, dagger, cosign, docker-compose, flux-source-controller, ratify, trivy, bom, tekton-chains, policy-controller,...

GO-2026-5023 vulnerabilities

Vulnerabilities for packages: flux, containerd, spire-server, osv-scanner, aactl, knative-serving, gitea, zarf, kyverno, cilium-cli, argocd-image-updater, snyk-cli, prometheus, kubescape, loki, zot, external-dns, gitlab-kas, trivy-operator, istio, k3s, kaf, minio, cilium, mattermost, fscrypt,...

GO-2026-5033 vulnerabilities

Vulnerabilities for packages: buildah, containerd, flux, spire-server, aactl, knative-serving, kyverno, cilium-cli, snyk-cli, prometheus, loki, zot, external-dns, gitlab-kas, istio, k3s, kaf, minio, cilium, mattermost, fscrypt, kubernetes, cert-manager, external-secrets-operator, podman, rancher,...

GO-2025-3754 vulnerabilities

Vulnerabilities for packages: gitsign, actions-runner-controller, rclone, crossplane-provider-family-aws, pulumi, lazygit, extism, crossplane-provider-aws-firehose, pulumi-kubernetes-operator, kots, pulumi-language-java, crossplane-provider-azure, crossplane-provider-aws-sqs, tkn, tfsec,...

GO-2024-2963 vulnerabilities

Vulnerabilities for packages: buildah, envoy-ratelimit, nfs-subdir-external-provisioner, kubernetes-csi-livenessprobe, step-ca, aws-load-balancer-controller, nri-mysql, authservice, vault-k8s, nats, addon-resizer, overmind, grype, bom, trust-manager, kustomize, rootlesskit, flannel,...

CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content no...

MAL-2026-11811 Malicious code in @servicetitan/acquisition-functions (npm)

npm/@servicetitan/acquisition-functions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

CVE-2026-66884 Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

Every Application Now Lives in an AI Ecosystem

Discover why modern applications are all part of the AI ecosystem, how real-time inference drives performance, and how to avoid hidden data transfer costs...

NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set vulnerability discovered by ? in WordPress Npm immutable versions 4.3.9...

EUVD-2026-42516

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\servicewrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full...

Malicious code in fmt-date-lite (npm)

The npm package fmt-date-lite is a supply-chain dropper disguised as a benign date-formatting utility its description reads "Lightweight date formatting utility with locale support". It ships six files, no source repository and no dependencies, with its real behaviour in an install script. A...

goshs: Share-link ?token=… redemption races past download limit

Share-link ?token=… redemption races past download limit Ecosystem: Go Package: goshs.de/goshs/v2 github.com/patrickhener/goshs Affected: 0 || entry.DownloadLimit == -1 // ...serve file... // = current.DownloadLimit deletefs.SharedLinks, token fs.sharedLinksMu.Unlock Between line 978 RUnlock and...

MAL-2026-6710 Malicious code in vitest-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e0165cbb3d6ed37a96889c4b016463706346e1c09413635c31ea1ceedde8774 The package's postinstall script node lib/utils/index.js spawns a detached, stdio-suppressed Node child process that runs...

PT-2026-55218

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.0.10 Description A race condition exists in the ShareHandler when processing share-link redemptions. The system reads the DownloadLimit of a share token using a read lock, releases it to serve the file, and only then...

CVE-2026-9222 Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access...

MAL-2026-6423 Malicious code in leo-connector-elasticsearch (npm)

The leo-connector-elasticsearch npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...