GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-solutions, external-secrets-fips, commercial-grafana, crossplane-provider-azure-orbital, crossplane-provider-azure-web, crossplane-provider-azure-alertsmanagement, cert-manager, grafana, splunk-otel-collector,...

GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: goreleaser, crossplane-provider-azure-storage, nfpm, gobuster, nuclei, crossplane-provider-azure-managedidentity, external-secrets-operator, cert-manager, splunk-otel-collector, crossplane-provider-azure-sql, telegraf, crossplane-provider-azure-authorization,...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6910 more potentially affected by CVE-2026-54513 via tools.jackson.core:jackson-databind (>=3.0.0 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves:...

Cross-Site Scripting (XSS)

Vitest is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the otelCarrier query parameter being inserted directly into an inline module script and treated as JavaScript source rather than data, which allows an attacker to craft a malicious browser-runner URL and execute...

Malicious code in @mastra/otel-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1998b4d1e4f2d960197b14f573628777e4456ff374f007ac39cca273a206aea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6031 Malicious code in @mastra/otel-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1998b4d1e4f2d960197b14f573628777e4456ff374f007ac39cca273a206aea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/otel-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a8b6a73558d739f5ae803c6330009938e0a19f5c6a1a7c0f01cf4884fbea9b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5958 Malicious code in @mastra/otel-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a8b6a73558d739f5ae803c6330009938e0a19f5c6a1a7c0f01cf4884fbea9b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

SUSE-SU-2026:21989-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: Update to version 20260430.00 Update THIRDPARTYLICENSES to be package specific location. 608 Update dependencies and go version to 1.26.2 607 bsc1265762, CVE-2026-33814 Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 604...

Cross-site Scripting (XSS)

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Cross-site Scripting XSS via the otelCarrier query parameter being directly inserted into an inline script without sanitization. An attacker can execute arbitrary JavaScript in the context...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +23809 more potentially affected by CVE-2026-42585 via io.netty:netty-codec-http (>=4.0.0.Alpha1 <=4.1.132.Final)

io.netty:netty-codec-http MAVEN version =4.0.0.Alpha1, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: multus-cni, kubernetes-csi-driver-hostpath, aws-efs-csi-driver, dgraph, prometheus, yace, jitsucom-bulker, neuvector-dbgen, sbom-convert, trillian, vault-env, docker-machine-driver-harvester, cosign, aws-s3-controller, pluto, rancher-webhook, kubewatch, mc, litestrea...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, crossplane-provider-aws-kms, grafana-alloy, crossplane-provider-aws-cloudformation, crossplane-provider-azure-managedidentity, crossplane-provider-azure-sql, crossplane-provider-aws-cloudwatchlogs,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-memorydb, datadog-agent, crossplane-provider-aws-kinesis-fips, crossplane-provider-aws-servicediscovery, crossplane-provider-gcp-fips, aws-otel-collector-fips, crossplane-provider-aws-iam,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-memorydb, datadog-agent, crossplane-provider-aws-kinesis-fips, crossplane-provider-aws-servicediscovery, crossplane-provider-gcp-fips, aws-otel-collector-fips, crossplane-provider-aws-iam,...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +152 more potentially affected by CVE-2026-34237 via io.modelcontextprotocol.sdk:mcp-core (=1.1.0)

io.modelcontextprotocol.sdk:mcp-core MAVEN version =1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - ai.agentican:agentican-framework-core =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1,...

Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)

Dependency on Vulnerable Third-Party Component in Elastic OTel Java Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component CWE-1395 exists in Elastic OTel Java via a dependency on OpenTelemetry Java instrumentation library. This vulnerability could allow an attacker to...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +19755 more potentially affected by CVE-2026-33871 via io.netty:netty-codec-http2 (>=4.1.0.Beta4 <=4.1.131.Final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.Beta4, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, pulumi, crossplane-provider-aws-cloudwatchlogs, pulumi-language-java, crossplane-provider-aws-kinesis, caddy, kube-logging-operator, zarf, gitlab-pages, pluto, pulumi-language-dotnet, k3s, crossplane-provider-aws-rds, apko,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, pulumi, crossplane-provider-aws-cloudwatchlogs, pulumi-language-java, crossplane-provider-aws-kinesis, caddy, kube-logging-operator, zarf, gitlab-pages, pluto, pulumi-language-dotnet, k3s, crossplane-provider-aws-rds, apko,...