Authorization Bypass Through User-Controlled Key

Overview apache-airflow-providers-microsoft-azure is a Provider package apache-airflow-providers-microsoft-azure for Apache Airflow Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the getconnvalue and getvariable paths in...

io.jenkins.plugins:artifactory-artifact-manager (>=318.v89d9642e6690, <=320.v6d1b_a_84b_16db), org.csanchez.jenkins.plugins:kubernetes (>=4467.vf26561292824, <=4560.vc25b_83890c34) +1 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (719.v80e905ef14eb)

org.jenkins-ci.plugins:credentials-binding MAVEN version 719.v80e905ef14eb is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:artifactory-artifact-manager...

com.antonzhdanov:sshd-cloud-agent-azure (>=1.0.0, <=1.0.2), com.azure.resourcemanager:azure-resourcemanager (>=1.0.0-hybrid, <=2.60.0) +136 more potentially affected by CVE-2026-33117 via com.azure:azure-security-keyvault-keys (>=4.2.0-beta.3, <=4.10.5)

com.azure:azure-security-keyvault-keys MAVEN version =4.2.0-beta.3, =1.0.0, =1.0.0-hybrid, =1.0.0-hybrid, =1.0.0-hybrid, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.14.0 and more Source cves: CVE-2026-33117https://vulners.com/cve/CVE-2026-33117...

com.antonzhdanov:sshd-cloud-agent-azure (>=1.0.0, <=1.0.2), com.azure.resourcemanager:azure-resourcemanager (>=1.0.0-hybrid, <=2.60.0) +136 more potentially affected by CVE-2026-33117 via com.azure:azure-security-keyvault-keys (>=4.2.0-beta.3, <=4.10.5)

com.azure:azure-security-keyvault-keys MAVEN version =4.2.0-beta.3, =1.0.0, =1.0.0-hybrid, =1.0.0-hybrid, =1.0.0-hybrid, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.14.0 and more Source cves: CVE-2026-33117https://vulners.com/cve/CVE-2026-33117...

com.antonzhdanov:sshd-cloud-agent-azure (>=1.0.0, <=1.0.2), com.azure.resourcemanager:azure-resourcemanager (>=1.0.0-hybrid, <=2.60.0) +136 more potentially affected by CVE-2026-33117 via com.azure:azure-security-keyvault-keys (>=4.2.0-beta.3, <=4.10.5)

com.azure:azure-security-keyvault-keys MAVEN version =4.2.0-beta.3, =1.0.0, =1.0.0-hybrid, =1.0.0-hybrid, =1.0.0-hybrid, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.14.0 and more Source cves: CVE-2026-33117https://vulners.com/cve/CVE-2026-33117...

com.antonzhdanov:sshd-cloud-agent-azure (>=1.0.0, <=1.0.2), com.azure.resourcemanager:azure-resourcemanager (>=1.0.0-hybrid, <=2.60.0) +136 more potentially affected by CVE-2026-33117 via com.azure:azure-security-keyvault-keys (>=4.2.0-beta.3, <=4.10.5)

com.azure:azure-security-keyvault-keys MAVEN version =4.2.0-beta.3, =1.0.0, =1.0.0-hybrid, =1.0.0-hybrid, =1.0.0-hybrid, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.14.0 and more Source cves: CVE-2026-33117https://vulners.com/cve/CVE-2026-33117...

io.jenkins.plugins:artifactory-artifact-manager (>=318.v89d9642e6690, <=320.v6d1b_a_84b_16db), org.csanchez.jenkins.plugins:kubernetes (>=4467.vf26561292824, <=4560.vc25b_83890c34) +1 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (719.v80e905ef14eb)

org.jenkins-ci.plugins:credentials-binding MAVEN version 719.v80e905ef14eb is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:artifactory-artifact-manager...

io.jenkins.docker:docker-plugin (1336.v3711dec712de), io.jenkins.plugins:docker-slaves (259.v43582a_63e8b_9) +4 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (717.v951d49b_5f3a_a)

org.jenkins-ci.plugins:credentials-binding MAVEN version 717.v951d49b5f3aa is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.docker:docker-plugin 1336.v3711dec712de -...

Microsoft Azure Arc security vulnerabilities

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A security vulnerability exists in Microsoft Azure Arc. An attacker could exploit the vulnerability to elevate privileges. The following products and versions are affected:Azure Arc...

Malicious code in keyvault-resource-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 151593a15a15d786dc804de8e2449b40fa1e3f9411665fce2244d426bb6c019d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4154 Malicious code in keyvault-resource-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 151593a15a15d786dc804de8e2449b40fa1e3f9411665fce2244d426bb6c019d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4153 Malicious code in keyvault-mock-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 343541e6f4209b857efb3416d3152bbabb5d12bd0e0cf285ab16c3b4292ad6a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keyvault-mock-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 343541e6f4209b857efb3416d3152bbabb5d12bd0e0cf285ab16c3b4292ad6a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4152 Malicious code in keyvault-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9aca799c76a35e0a46dc06bdafb92bec3d0d8d570f2675d3917542bb2693ba51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keyvault-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9aca799c76a35e0a46dc06bdafb92bec3d0d8d570f2675d3917542bb2693ba51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5286 Malicious code in perf-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9003463e95619d4e40f5507d682e1e9f6c51dfe0d607c8397e22babb820bd8d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-keyvault-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ba3ff274677edafd94d8d2a447ff201db5d546d8ae4a87e38723189c151d6a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9003463e95619d4e40f5507d682e1e9f6c51dfe0d607c8397e22babb820bd8d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5287 Malicious code in perf-keyvault-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ba3ff274677edafd94d8d2a447ff201db5d546d8ae4a87e38723189c151d6a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-keyvault-secrets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e52e7851b3adaafd64c17c5ca82e39af754c9344a91b8fb551136e37387c45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...