646 matches found
EUVD-2026-68449
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucke...
CVE-2026-82861 @hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucke...
EUVD-2026-68448
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
CVE-2026-82855 @hulumi/policies before 1.3.2 Evidence Validation Bypass
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...
EUVD-2026-68443
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...
CVE-2026-82855
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass in the Cloudflare and deployment-governance validators. Attackers can submit compliant evidence from unrelated resources—such as different zones, hostnames, origins, or repositories—to suppress violations for unrelated r...
CVE-2026-82855 @hulumi/policies before 1.3.2 Evidence Validation Bypass
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...
MINI-6R93-W758-42G8
Bulletin has no description...
CVE-2026-17186
creationtimestamp| type| source ---|---|--- 2026-08-14 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt2y7wfw4m2t 2026-08-14 21:10:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eam25mpy65fsm 2026-08-15 01:30:25+00:00| seen|...
IAM Compliance Requirements and Best Practices
IAM compliance is the practice of demonstrating that identity and access controls are not only documented but actually enforced across users, applications, infrastructure, and non-human identities. This guide explains what IAM compliance requires, which regulations matter, and how organizations...
CVE-2026-67180 Google Turbinia arbitrary command execution
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10...
GHSA-4WX2-7GVJ-QFQ3
creationtimestamp| type| source ---|---|--- 2026-08-05 09:31:26+00:00| seen| https://gist.github.com/alon710/8a67496a2aeb5dc5719baf5a0f706ea5...
paseo-poc-repo-trust
paseo-poc-repo-trust — DEMO PoC repository ⚠️ This is a sec...
spar
SPAR backend Python core: attacker/defender agents, orchestra...
Exploit for CVE-2026-66066
rails-activestorage-vips-audit An Agent Skillhttps://agent...
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
Summary Heap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read ...
CVE-2026-61951
creationtimestamp| type| source ---|---|--- 2026-07-23 13:08:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvta62f32r...
CVE-2026-60292
creationtimestamp| type| source ---|---|--- 2026-07-21 23:48:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ynsyrfe2v 2026-07-23 16:50:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-29 17:07:07+00:00| seen|...
EUVD-2026-46251
Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox...
SecureAI-Scan v0.4.0
SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...