Malicious code in google-logging-utils-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60ff4b97c24301c3b850c5c7f2c1a6dfc07c695c2b19c879cc766373f1c2ded2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2026-5339 vulnerabilities

Vulnerabilities for packages: kube-logging-operator-fips, kube-logging-operator...

GO-2026-5339 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs, flyte, cass-operator, kube-bench, omnibump, grafana-operator, pulumi-kubernetes-operator, timoni, chisel, crossplane-provider-aws-lambda, dbmate, witness, wuzz, spqr, q, terraform-provider-azurerm, kubevela, prometheus,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: verticadb-operator, crossplane-provider-aws-cloudwatchlogs, gitleaks, cass-operator, headlamp, kube-bench, grafana-operator, timoni, chisel, crossplane-provider-aws-lambda, dbmate, wuzz, spqr, eksctl, mesosphere-vsphere-csi, stakater-reloader, grafana-rollout-operato...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: pluto, headlamp, kube-bench, terraform-provider-azapi, witness, eksctl, prometheus, oauth2-proxy, grafana-rollout-operator, kubecolor, step-kms-plugin, glow, tekton-chains, tflint, nats-server-config-reloader, aws-otel-collector, caddy, terraform, nri-rabbitmq, cerbo...

CVE-2026-12364: Untrusted Pointer Dereference

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

GHSA-5PQ8-3FFP-7W5M hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

CLEANSTART-2026-TD71000 Security fixes in kube-logging-operator 6.5.2-r1

Package kube-logging-operator version 6.5.2-r1 fixes 4 vulnerabilities: CVE-2026-47701, ghsa-cxh2-4639-vmc5, ghsa-hrxh-6v49-42gf, CVE-2026-46600...

CLEANSTART-2026-KD98941 Security fixes in kube-logging-operator 6.6.0-r1

Package kube-logging-operator version 6.6.0-r1 fixes 4 vulnerabilities: CVE-2026-47701, ghsa-cxh2-4639-vmc5, ghsa-hrxh-6v49-42gf, CVE-2026-46600...

CLEANSTART-2026-TQ54429 Security fixes in kube-logging-operator 6.7.0-r2

Package kube-logging-operator version 6.7.0-r2 fixes 9 vulnerabilities: CVE-2026-56852, CVE-2026-46600, CVE-2026-44024, CVE-2026-44025, CVE-2026-44160...

CLEANSTART-2026-QW78358 Security fixes in kube-logging-operator 6.4.0-r1

Package kube-logging-operator version 6.4.0-r1 fixes 4 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-33814...

PT-2026-76575

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

Linux Distros Unpatched Vulnerability : CVE-2026-18710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log...

CVE-2026-18097

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files...

EUVD-2026-57619

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files...

CVE-2026-18097 IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files...

EUVD-2026-57549

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging

A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML outpu...