438 matches found
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...
CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
PT-2026-66499
Name of the Vulnerable Software and Affected Versions OpenCost versions prior to 1.121.0 Description Authentication is not properly enforced for the 'GET /helmValues' endpoint, which exposes the base64-decoded HELM VALUES environment variable containing cloud provider credentials. Furthermore, th...
CVE-2026-16481
A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...
CVE-2026-12715
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
EUVD-2026-45187
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
PT-2026-60778
Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. This vulnerability was patched on 15 April 2026, and no...
GHSA-JHVQ-4R2H-7C2Q vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu, linux-qemu-melange...
GHSA-M424-X6WR-WWGW vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu, linux-qemu-melange...
CVE-2026-45945 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange, linux-azure, linux-vmware, linux-gcp, linux-aws, linux-qemu...
GHSA-W447-HXJ8-XQ6P vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu, linux-qemu-melange...
CVE-2026-53260 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu, linux-qemu-melange...
GHSA-38H5-PJW3-MQXF vulnerabilities
Vulnerabilities for packages: linux-aws, linux-qemu-melange...
CVE-2026-45961 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-XX4X-7C38-RPQ3 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...