Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

MINI-2MP3-2VJ8-JPPR

Bulletin has no description...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: net-kourier, crossplane-provider-aws-cloudformation, blob-csi, percona-server-mongodb-operator, victoriametrics-operator, nri-mysql, stern, k8sgpt, stakater-reloader, chart-testing, crossplane-provider-aws-cloudwatchlogs, go-discover, aactl, smokescreen, pdfcpu,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: net-kourier, crossplane-provider-aws-cloudformation, blob-csi, percona-server-mongodb-operator, victoriametrics-operator, nri-mysql, stern, k8sgpt, stakater-reloader, chart-testing, crossplane-provider-aws-cloudwatchlogs, go-discover, aactl, smokescreen, pdfcpu,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: net-kourier, cilium, crossplane-provider-aws-cloudformation, blob-csi, percona-server-mongodb-operator, victoriametrics-operator, nri-mysql, stern, k8sgpt, stakater-reloader, chart-testing, crossplane-provider-aws-cloudwatchlogs, go-discover, aactl, smokescreen,...

CVE-2026-56859 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, net-kourier, k9s, falcosidekick, rabbitmq-messaging-topology-operator, sftpgo-plugin-eventsearch, tfsec, ferretdb, argo-cd, crossplane, blob-csi, crossplane-provider-aws-cloudformation, percona-server-mongodb-operator, telegraf,...

GO-2026-6088 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, net-kourier, k9s, falcosidekick, rabbitmq-messaging-topology-operator, sftpgo-plugin-eventsearch, tfsec, ferretdb, argo-cd, crossplane, blob-csi, crossplane-provider-aws-cloudformation, percona-server-mongodb-operator, telegraf,...

CVE-2026-56860 vulnerabilities

Vulnerabilities for packages: net-kourier, cilium, crossplane-provider-aws-cloudformation, blob-csi, percona-server-mongodb-operator, victoriametrics-operator, stern, k8sgpt, stakater-reloader, chart-testing, crossplane-provider-aws-cloudwatchlogs, go-discover, aactl, smokescreen, pdfcpu,...

GO-2026-6218 vulnerabilities

Vulnerabilities for packages: net-kourier, cilium, crossplane-provider-aws-cloudformation, blob-csi, percona-server-mongodb-operator, victoriametrics-operator, stern, k8sgpt, stakater-reloader, chart-testing, crossplane-provider-aws-cloudwatchlogs, go-discover, aactl, smokescreen, pdfcpu,...

CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...

GO-2026-4803 vulnerabilities

Vulnerabilities for packages: minio...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: authservice, crossplane-provider-aws-rds-fips, swagger, sftpgo-plugin-kms, aws-node-termination-handler-fips, amazon-ecs-agent-fips, yunikorn-k8shim-fips, secrets-store-csi-driver-provider-aws, elastic-agent, spegel-fips, openbao-fips, k8s-metacollector,...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: aactl, pulumi-language-java...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: authservice, openbao, opentelemetry-collector, vault-k8s, swagger, sftpgo-plugin-kms, flyte, openbao-fips, crossplane-provider-aws-sqs, prometheus-postgres-exporter, atlantis-fips, nsc, tempo, flux-image-reflector-controller, fulcio-fips, node-problem-detector,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: k8sgpt-operator, falcosidekick, temporal, ferretdb, tempo, dbmate, kots, spicedb, guac, cilium-cli, k3d, ksops, osv-scanner, sigstore-scaffolding, k8sgpt, minio, pulumi-language-dotnet, k3s, step, zarf, kubernetes-csi-driver-hostpath, spegel, step-ca,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: consul-k8s, k9s, teleport, argocd-image-updater, argo-cd, rancher-agent, kots, cilium-cli, zarf, linkerd2, rancher-fleet, kubescape, kubescape-operator, helm-set-status, tw, eksctl, kyverno-notation-aws, helm-operator, oras, trivy-operator, conftest, kargo, helm-push...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, argocd-image-updater, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, osv-scanner, zarf, argo-workflows, task, k8sgpt, gptscript, chezmoi, argo-events, pulumi-language-dotnet, snyk-cli, pulumi-language-java, kubescape, apko, grype,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, argocd-image-updater, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, osv-scanner, zarf, argo-workflows, task, k8sgpt, gptscript, chezmoi, argo-events, pulumi-language-dotnet, snyk-cli, pulumi-language-java, kubescape, apko, grype,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, teleport, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, scorecard, guac, osv-scanner, cerbos, argo-workflows, zarf, chezmoi, gptscript, argo-events, pulumi-language-dotnet, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, apko,...