CVE-2026-82857

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy . The root cause is insufficient boundary restrictions on role lifecycle operations targeting af-e2e-* roles, allowing an attacker with the documented principal to create persistent hig...

CVE-2026-82857 hulumi before v1.3.2 Privilege Escalation via IAM Policy

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

EUVD-2026-68445

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

CVE-2026-82856

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. The root cause is the insufficient handling of operators such as ForAnyValue:StringLike , which attackers can exploit to hide wildcard GitHub Actions OIDC subj...

EUVD-2026-68444

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

CVE-2026-82856 @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

CVE-2026-82855

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass in the Cloudflare and deployment-governance validators. Attackers can submit compliant evidence from unrelated resources—such as different zones, hostnames, origins, or repositories—to suppress violations for unrelated r...

CVE-2026-82856 @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

OPENSUSE-SU-2026:20020-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 143.0.7499.192 boo1256067: CVE-2026-0628: Insufficient policy enforcement in WebView tag - Chromium 143.0.7499.169 stable released 2025-12-18 no cve listed yet Chromium 143.0.7499.146 boo1255115: CVE-2025-14765:...

CVE-2026-82838

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82838

Venueless 's default Docker image had a vulnerability where uploaded SVG files could be served with executable JavaScript content, potentially allowing stored XSS. The root cause was the absence of a proper Content Security Policy (CSP) in the image's default configuration. The fix sets a valid C...

EUVD-2026-68392

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82838 Default webserver configuration with incorrect CSP

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-81852

Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...

Fedora 43 : bind (2026-875d2a5154)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-875d2a5154 advisory. Fixes multiple CVEs - Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 - Key Record using PRIVATEDNS algorithm may lead to exit...

Fedora 44 : bind (2026-d87e7f498a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d87e7f498a advisory. Fixes multiple CVEs - Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 - Key Record using PRIVATEDNS algorithm may lead to exit...

CVE-2026-51676

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setAccessDeviceCfg function. An unauthenticated network attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter access-device policies , with potential high impact on both c...

CVE-2026-51702

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-80223

Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path...

CVE-2026-77454

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit or frommany? and a parent...-referencing filter or sort. AshSql.Join.relatedquery/3 skips the caller-supplie...