GO-2026-6607 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth-fips, grafana-mimir, doppler-kubernetes-operator, crossplane-provider-aws-pinpoint-fips, yace, aws-network-policy-agent-fips, longhorn-engine, drone-fips, src-fingerprint-fips, influxd-fips, terraform-provider-tls-fips, plutono-fips,...

GHSA-F5VF-8PVC-394G vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth-fips, grafana-mimir, doppler-kubernetes-operator, crossplane-provider-aws-pinpoint-fips, yace, longhorn-engine, drone-fips, src-fingerprint-fips, influxd-fips, terraform-provider-tls-fips, plutono-fips, crossplane-provider-aws-budgets-fips,...

CVE-2026-56866 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth-fips, grafana-mimir, doppler-kubernetes-operator, crossplane-provider-aws-pinpoint-fips, yace, longhorn-engine, drone-fips, src-fingerprint-fips, influxd-fips, terraform-provider-tls-fips, plutono-fips, crossplane-provider-aws-budgets-fips,...

EUVD-2026-44635

n8n: External Secrets Permission Bypass via Expression Parser Mismatch...

Authorization Bypass Through User-Controlled Key

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a mismatch between static validation and the runtime expression engine in external secrets handling. An attacker can access unauthorized secret...

CVE-2026-59259

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the...

CVE-2026-59259 n8n - Permission Bypass via Expression Parser Mismatch in External Secrets

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the...

CVE-2026-59259 n8n - Permission Bypass via Expression Parser Mismatch in External Secrets

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the...

PYSEC-2026-1687 Unauthenticated views may expose information to anonymous users

Impact A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated anonymous users, including the following: - /api/graphql/ 1 - /api/users/users/session/ Nautobot 2.x only; the only information exposed to an anonymous user is which authentication backend classes...

airflow-tools (>=0.9.0, <=0.11.0), risk-custom-secrets-provider (>=1.0.9, <=1.1.3) potentially affected by CVE-2026-45361 via apache-airflow-providers-google (10.23.0)

apache-airflow-providers-google PYPI version 10.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-tools =0.9.0, =1.0.9, =1.1.3 Source cves: CVE-2026-45361 Source advisory:...

EUVD-2025-199391

Malicious code in @voiceflow/secrets-provider npm...

Malicious code in @voiceflow/secrets-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 527df6a20822831f2bc2435e1db61fcc192d163d6a81240078e8e93066dc1235 The package @voiceflow/secrets-provider was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191371 Malicious code in @voiceflow/secrets-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 527df6a20822831f2bc2435e1db61fcc192d163d6a81240078e8e93066dc1235 The package @voiceflow/secrets-provider was found to contain malicious code. Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Microsoft Azure Arc 安全漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A security vulnerability exists in Microsoft Azure Arc. An attacker could exploit the vulnerability to elevate privileges. The following products and versions are affected:Azure Arc...