CVE-2026-31579 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

CVE-2026-31591 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

CVE-2026-43107 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

GHSA-9RPM-78H2-FVW5 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

GHSA-R529-G827-7GF5 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

GHSA-V6VR-F94R-R434 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

CVE-2026-43101 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

CVE-2026-43103 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

GHSA-6447-4W47-GH9G vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

CVE-2026-43102 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-vmware, linux-azure, linux-gcp...

CVE-2026-43500 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-gcp, linux-vmware, linux-azure, linux-qemu-melange, linux-qemu-rc...

Malicious Package

Overview apple-infra-gcp-leak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @mistralai/mistralai-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcfd7fec176cc54232767b454429a7b3e0106aebbb16f2e9bdacc57e8a20ff9 The package @mistralai/mistralai-gcp was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3512 Malicious code in @mistralai/mistralai-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcfd7fec176cc54232767b454429a7b3e0106aebbb16f2e9bdacc57e8a20ff9 The package @mistralai/mistralai-gcp was found to contain malicious code. Source: ghsa-malware...

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: bazelisk, kubernetes, azuredisk-csi, actions-runner-controller, grafana-pyroscope, step, k8ssandra-operator, argo-events, grafana-agent-operator, grafana-operator, cert-exporter, terraform-provider-google, mariadb-operator, net-kourier, coredns, distribution,...

CVE-2026-40981

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater...