CVE-2026-48033 Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0...

CVE-2026-48033 Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0...

CVE-2026-48033

CVE-2026-48033 affects Hulumi before version 1.4.0. The vulnerability arises in the policy packs component: policy rules incorrectly trust URNs and can be bypassed when a developer names a resource with a trusted substring in the Pulumi-URN, allowing exemptions to be applied to resources that sho...

CVE-2026-48033 Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0...

CVE-2026-48032

Hulumi (open-source toolkit for Pulumi) contains a vulnerability in the @hulumi/policies that affects IAM-role policy checks. Before v1.4.0, the policy validators incorrectly handled a JSON array in Principal.Federated, bypassing checks when a role trusts multiple OIDC providers. This could allow...

CVE-2026-48032 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0...

CVE-2026-48032 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0...

GHSA-VGHG-5JRG-2398 ImageMagick: Policy Bypass in script operation due to missing checks

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy...

ImageMagick: Policy Bypass in script operation due to missing checks

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy...

GHSA-V3J6-27VC-7PW2 ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path...

ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to an incomplete fix in the policy. An attacker can gain unauthorized access to restricted functionality or data by bypassing intended security policies. Remediation A fix was pushed into the master branch bu...

ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219

An incomplete fix of CVE-2026-49219 could result in a policy bypass...

ImageMagick: Policy Bypass possible with matrix-backed operations

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed...

EUVD-2026-41112

ImageMagick: Policy Bypass in concatenate operation due to missing checks...

GHSA-82MP-VP5C-9PF7 ImageMagick: Policy Bypass in concatenate operation due to missing checks

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy...

ImageMagick: Policy Bypass in concatenate operation due to missing checks

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66144

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...