PT-2026-42687

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.23.0 Description Runtime pods were configured with the fission-fetcher ServiceAccount, which possesses namespace-wide get permissions for secrets and configmaps. Because the service account token was automounted and...

PT-2026-42613

This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production In OpenMetadata 1.12.1, a non-admin SSO user can trigger a TEST CONNECTION workflow for a Database Service and receive, in the...

Malicious code in supership-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aebde5ba55a72b6d4c6917ccf22db1427d434fed04cecc22dd16844e2d39033 The package advertises itself as a local-only static analyzer README: "Runs locally. Your code never leaves the machine" and "What's never transmitte...

MAL-2026-4675 Malicious code in supership-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aebde5ba55a72b6d4c6917ccf22db1427d434fed04cecc22dd16844e2d39033 The package advertises itself as a local-only static analyzer README: "Runs locally. Your code never leaves the machine" and "What's never transmitte...

CVE-2026-9129

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: argo-events, guac, act, argo-workflows, teleport, kubevela, kyverno, tfsec, kubescape, gomplate, terragrunt, src-fingerprint, gitaly, grype, zarf, argo-cd, pulumi-language-java, apko, kots, cerbos, goreleaser, gitlab-runner, melange, flux-image-automation-controller,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: argo-events, guac, act, argo-workflows, teleport, kubevela, kyverno, tfsec, kubescape, gomplate, terragrunt, src-fingerprint, gitaly, grype, zarf, argo-cd, pulumi-language-java, apko, kots, cerbos, goreleaser, gitlab-runner, melange, flux-image-automation-controller,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: argo-events, guac, act, argo-workflows, teleport, kubevela, kyverno, tfsec, kubescape, gomplate, terragrunt, src-fingerprint, gitaly, grype, zarf, argo-cd, pulumi-language-java, apko, kots, cerbos, goreleaser, gitlab-runner, melange, flux-image-automation-controller,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: argo-events, guac, act, argo-workflows, teleport, kubevela, kyverno, tfsec, kubescape, gomplate, terragrunt, src-fingerprint, gitaly, grype, zarf, argo-cd, pulumi-language-java, apko, kots, cerbos, goreleaser, gitlab-runner, melange, flux-image-automation-controller,...

Malicious code in @ctrl/plex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20e1aad15739a79a359d88099a004fa395b66df8845c10823824e848f095c568 The @ctrl/ npm scope was compromised in the Shai-Hulud supply-chain incident September 2025. Versions of @ctrl/plex published during and after the...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, argo-events, argocd-image-updater-fips, gitlab-rails-ce, cloudbeat-fips, zarf-fips, src-fingerprint-fips, argo-cd-fips, kubevela-fips, pulumi-language-yaml, packer-fips, rancher-fleet, gitea, xeol-fips, chainloop-cli-fips, google-osconfig-agent,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, argo-events, argocd-image-updater-fips, gitlab-rails-ce, cloudbeat-fips, zarf-fips, src-fingerprint-fips, argo-cd-fips, kubevela-fips, pulumi-language-yaml, packer-fips, rancher-fleet, gitea, xeol-fips, chainloop-cli-fips, google-osconfig-agent,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, argo-events, argocd-image-updater-fips, gitlab-rails-ce, cloudbeat-fips, zarf-fips, src-fingerprint-fips, argo-cd-fips, kubevela-fips, pulumi-language-yaml, packer-fips, rancher-fleet, gitea, xeol-fips, chainloop-cli-fips, google-osconfig-agent,...

EUVD-2026-31148

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

CVE-2026-9129

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

CVE-2026-9129

The CVE-2026-9129 entry concerns Altium Enterprise Server Viewer StorageController. On on‑prem deployments using local filesystem storage, an authenticated user can supply a URL-encoded absolute path in a Viewer storage API request, causing the storage root to be discarded and enabling arbitrary ...

CVE-2026-9129 Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

CVE-2026-9129 Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

MAL-2026-4191 Malicious code in iv-bloomfilter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7f2a3b58036e1174efe383ee906172b07f9ddc3410d913e51b4e614f9ff09ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iv-stubborn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b8934157781e3457974f0609c54f14503424c9077b316f2e8e843e454989922 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects the installer's hostname, all non-internal network...