Cross-Site Scripting (XSS)

Vitest is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the otelCarrier query parameter being inserted directly into an inline module script and treated as JavaScript source rather than data, which allows an attacker to craft a malicious browser-runner URL and execute...

Malicious code in @mastra/otel-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1998b4d1e4f2d960197b14f573628777e4456ff374f007ac39cca273a206aea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6031 Malicious code in @mastra/otel-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1998b4d1e4f2d960197b14f573628777e4456ff374f007ac39cca273a206aea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/otel-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a8b6a73558d739f5ae803c6330009938e0a19f5c6a1a7c0f01cf4884fbea9b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5958 Malicious code in @mastra/otel-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a8b6a73558d739f5ae803c6330009938e0a19f5c6a1a7c0f01cf4884fbea9b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

SUSE-SU-2026:21989-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: Update to version 20260430.00 Update THIRDPARTYLICENSES to be package specific location. 608 Update dependencies and go version to 1.26.2 607 bsc1265762, CVE-2026-33814 Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 604...

Cross-site Scripting (XSS)

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Cross-site Scripting XSS via the otelCarrier query parameter being directly inserted into an inline script without sanitization. An attacker can execute arbitrary JavaScript in the context...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: runc, spark-operator, kube-vip, kubeflow, apko, rabbitmq-messaging-topology-operator, gitlab-pages, pdfcpu, policy-controller, temporal-ui-server, kubescape-operator, terraform-provider-tls, controller-gen, kapp, rancher-fleet, malcontent,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-cloudfront, telegraf, crossplane-provider-family-aws, crossplane-provider-keycloak, crossplane-provider-aws-memorydb, crossplane-provider-family-azure, amazon-cloudwatch-agent, crossplane-provider-aws-eks,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, crossplane-provider-aws-dynamodb, crossplane-provider-aws-backup-fips, crossplane-provider-aws-elasticache, crossplane-provider-aws-servicediscovery, crossplane-provider-aws-sns-fips, crossplane-provider-aws-elbv2,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, crossplane-provider-aws-dynamodb, crossplane-provider-aws-backup-fips, crossplane-provider-aws-elasticache, crossplane-provider-aws-servicediscovery, crossplane-provider-aws-sns-fips, crossplane-provider-aws-elbv2,...

Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)

Dependency on Vulnerable Third-Party Component in Elastic OTel Java Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component CWE-1395 exists in Elastic OTel Java via a dependency on OpenTelemetry Java instrumentation library. This vulnerability could allow an attacker to...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, kube-vip, crossplane-provider-aws-memorydb, goreleaser, cluster-api-azure-controller, apko, gitlab-pages, terraform-provider-grafana, kyverno-policy-reporter, nova, crossplane-provider-aws-sns, opa-envoy,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, kube-vip, crossplane-provider-aws-memorydb, goreleaser, cluster-api-azure-controller, apko, gitlab-pages, terraform-provider-grafana, kyverno-policy-reporter, nova, crossplane-provider-aws-sns, opa-envoy,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: cg, trivy, zot, deck-fips, descheduler, seaweedfs-fips, tigera-operator, flux-kustomize-controller, omnictl-multiarch-fips, crossplane-provider-aws-dynamodb, crossplane-provider-aws-backup-fips, pulumi-language-dotnet, omni-fips, caddy-fips, amazon-ssm-agent-fips,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: cg, trivy, zot, deck-fips, descheduler, seaweedfs-fips, tigera-operator, flux-kustomize-controller, omnictl-multiarch-fips, crossplane-provider-aws-dynamodb, crossplane-provider-aws-backup-fips, pulumi-language-dotnet, omni-fips, caddy-fips, amazon-ssm-agent-fips,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: trivy, hydra-fips, spicedb-operator, zitadel, docker, cloud-provider-azure-fips, cloud-provider-azure, gitlab-operator, scorecard, gitlab-operator-fips, grype-db, prometheus-adapter, descheduler-fips, etcd, buildkitd, docker-compose, rke2-runtime, k6,...

AZL-78653 CVE-2026-27141 affecting package azl-otel-collector 0.127.0-1

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: runc, crossplane-provider-aws-elasticache, terraform-provider-acme, spark-operator, sftpgo-plugin-kms, kube-vip, kubeflow, kube-vip-cloud-provider, src-fingerprint, gitlab-pages, pdfcpu, terraform-provider-grafana, terraform-provider-tls, controller-gen, kapp,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: runc, crossplane-provider-aws-elasticache, terraform-provider-acme, minify, spark-operator, sftpgo-plugin-kms, kube-vip, wire-go, kubeflow, ini-file, kube-vip-cloud-provider, src-fingerprint, gitlab-pages, pdfcpu, terraform-provider-grafana, terraform-provider-tls,...