CVE-2026-48816 vulnerabilities

Vulnerabilities for packages: pulumi...

GHSA-XGJW-PM74-86Q4 vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48815 vulnerabilities

Vulnerabilities for packages: graalvm, pulumi...

GHSA-52V5-JR5W-GJXR vulnerabilities

Vulnerabilities for packages: graalvm, pulumi...

GHSA-52V5-JR5W-GJXR vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48815 vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48816 vulnerabilities

Vulnerabilities for packages: pulumi...

GHSA-XGJW-PM74-86Q4 vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48758 vulnerabilities

Vulnerabilities for packages: graalvm, pulumi...

GHSA-JFC7-64V2-MR8C vulnerabilities

Vulnerabilities for packages: graalvm, pulumi...

GHSA-JFC7-64V2-MR8C vulnerabilities

Vulnerabilities for packages: pulumi...

CVE-2026-48758 vulnerabilities

Vulnerabilities for packages: pulumi...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: teleport-operator-fips, cloud-provider-aws, frankenphp-8.2, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-elbv2, gitlab-pages, crossplane-provider-aws-ram-fips, crossplane-provider-aws-route53resolver, prometheus-operator, witness,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: teleport-operator-fips, cloud-provider-aws, frankenphp-8.2, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-elbv2, gitlab-pages, crossplane-provider-aws-ram-fips, crossplane-provider-aws-route53resolver, prometheus-operator, witness,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: teleport-operator-fips, tigera-operator, zarf, cloud-provider-aws, frankenphp-8.2, argo-events-fips, juicefs, datadog-agent-fips, nerdctl, gh, prometheus-operator, commercial-expanso-edge, omnictl-multiarch-fips, witness, trufflehog-fips, knative-kafka-broker-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: eksctl, tflint, crossplane-provider-aws-cloudformation, gptscript, vitess, scorecard, terraform-provider-azurerm, zarf, external-secrets-operator, witness, policy-controller, crossplane-provider-azure-storage, pulumi, crossplane-provider-aws-firehose, go-discover,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: eksctl, tflint, zarf, gptscript, vitess, scorecard, terraform-provider-azurerm, external-secrets-operator, witness, policy-controller, crossplane-provider-azure-storage, pulumi, go-discover, terragrunt, kyverno, fscrypt, rancher-machine, gomplate,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: cert-manager, prometheus-operator, opentofu, kubernetes-dashboard, apko, gptscript, scorecard, guac, mattermost, osv-scanner, external-secrets-operator, spire-server, vitess, witness, zarf, k9s, pulumi, wolfictl, telegraf, syft, trivy-operator, zot, aactl, podman,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: zarf, gptscript, vitess, scorecard, external-secrets-operator, witness, pulumi, go-discover, terragrunt, kyverno, fscrypt, gomplate, step-issuer, pulumi-language-dotnet, kaf, act, prometheus, argocd-image-updater, cilium, buildah, opentofu, kubernetes-dashboard,...

@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name

Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-693 Protection Mechanism Failure Summary Pulumi gives every cloud resource a structured URN that includes the resource's type chain hulumi:baseline:aws:SecureBucket$aws:s3/bucketV2:BucketV2 and the logical name the develope...