@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-284 Improper Access Control Summary HULUMI-H1 forbids raw aws:s3:Bucket outside of Hulumi's SecureBucket component, with one exemption: a raw bucket that's a child of a SecureBucket is allowed because the component is...

MINI-QRR7-FM24-57Q7

Bulletin has no description...

MINI-J96J-HG2W-4R85

Bulletin has no description...

MINI-WJP5-W33M-FRR3

Bulletin has no description...

MINI-GJGF-FC8W-HMWJ

Bulletin has no description...

MINI-PQXG-V2W6-XHR7

Bulletin has no description...

MINI-H824-8MHF-M29R

Bulletin has no description...

MINI-532R-22CQ-G77R

Bulletin has no description...

MINI-X6MQ-VWXP-W35P

Bulletin has no description...

MINI-VCG5-QFXH-34Q2

Bulletin has no description...

MINI-Q494-FV5R-GHRM

Bulletin has no description...

CVE-2026-40988

creationtimestamp| type| source ---|---|--- 2026-06-10 05:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvwjukb4q2n...

SUSE CVE-2026-46316

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgicitsinvalidatecache walks the per-ITS translation cache with xaforeach and drops the cache's reference on each entry with vgicputirq. It puts...

CLEANSTART-2026-MY46883 (*x509

Multiple security vulnerabilities affect the mockgen package. x509. See references for individual vulnerability details...

EUVD-2026-35879

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary userid because the getitemspermissionscheck meth...

CVE-2026-53675

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary userid because the getitemspermissionscheck meth...

Fission 访问控制错误漏洞

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.24.0 contained a access control vulnerability. This vulnerability stemmed from the lack of namespace validation using the access webhook in the Fission Function specification for...

PT-2026-48505

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0 Description An issue exists in the Fission serverless framework where the admission webhook fails to validate the namespace for the PackageRef.Namespace reference type. While Secret and ConfigMap reference type...

PT-2026-48476

Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.4.0 Description A bypass exists in the H5 defense-in-depth check of the Hulumi hardening pack. The H5 check is designed to verify that raw aws:s3:Bucket resources acting as children of a SecureBucket...

CVE-2026-53675 BuddyPress 14.4.0 Friends List IDOR via REST API

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary userid because the getitemspermissionscheck meth...