1583 matches found
CVE-2026-42811 Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions
In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials b...
CVE-2026-42811 Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions
In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials b...
CVE-2026-42811
CVE-2026-42811 : Apache Polaris builds Google Cloud Storage downscoped credentials via a Credential Access Boundary (CAB) with CEL conditions intended to constrain to a table path. The CEL string uses the bucket and table path; if a namespace/table identifier contains special content (e.g., a sin...
CVE-2026-42811 Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions
In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials b...
GHSA-2274-3HGR-WXV6 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-qemu, linux-aws...
OPENSUSE-SU-2026:20669-1 Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-34986: github.com/go-jose/go-jose/v4: processing of JWE object with empty encryptedkey field but key wrapping algorithm set can lead to a denial of service bsc1262936...
SUSE-SU-2026:21540-1 Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-34986: github.com/go-jose/go-jose/v4: processing of JWE object with empty encryptedkey field but key wrapping algorithm set can lead to a denial of service bsc1262936...
Apache Polaris 输入验证错误漏洞
Apache Polaris is a data management and query service component of the Apache Foundation. Version 1.4.0 of Apache Polaris contains a vulnerability related to input validation. This vulnerability arises from the lack of escaping of namespace or table identifiers when constructing Google Cloud...
Malicious code in google-cloud-secret-manager-config-poc (npm)
Malicious npm package published by the microsop threat actor as part of a dependency-confusion campaign that impersonates internal tooling at Microsoft, Google Cloud, and PayPal using inflated semver values e.g. 99.9.x, 100.1.x to win npm resolution against private internal packages. All packages...
MAL-2026-3309 Malicious code in google-cloud-secret-manager-config-poc (npm)
Malicious npm package published by the microsop threat actor as part of a dependency-confusion campaign that impersonates internal tooling at Microsoft, Google Cloud, and PayPal using inflated semver values e.g. 99.9.x, 100.1.x to win npm resolution against private internal packages. All packages...
PT-2026-36670
Name of the Vulnerable Software and Affected Versions Apache Polaris version 1.4.0 Description Apache Polaris fails to properly escape namespace and table identifiers when constructing Common Expression Language CEL strings for Google Cloud Storage GCS Credential Access Boundaries CAB. This allow...
CVE-2026-31580 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-qemu, linux-aws...
CVE-2026-31619 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-qemu, linux-aws...
CVE-2026-31622 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-qemu, linux-aws...
GHSA-879H-M867-CPJQ vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-qemu, linux-aws...
GHSA-8WC2-723Q-HF3G vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-qemu, linux-aws...
GHSA-9M92-4VQV-MRJ9 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-qemu, linux-aws...
GHSA-Q8HH-7XG8-PFVM vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-qemu, linux-aws...