Malicious code in @qlik/carboncopy (npm)

npm/@qlik/carboncopy is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

MAL-2026-11598 Malicious code in @onereach/expression-components (npm)

npm/@onereach/expression-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLEANSTART-2026-KO16921 Security fixes in vault-k8s 1.7.5-r0

Package vault-k8s version 1.7.5-r0 fixes 3 vulnerabilities: CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-JI06549 Security fixes in vault-k8s 1.7.4-r0

Package vault-k8s version 1.7.4-r0 fixes 31 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33811, CVE-2026-33814...

CLEANSTART-2026-BJ78140 Security fixes in vault-k8s 1.7.1-r0

Package vault-k8s version 1.7.1-r0 fixes 1 vulnerabilities: CVE-2025-61729...

CLEANSTART-2026-BI19096 Security fixes for CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39822, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42505, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, CVE-2026-56852 applied in versions: 1.7.0-r0, 1.7.1-r0, 1.7.4-r0, 1.7.5-r0

Multiple security vulnerabilities affect the vault-k8s package. These issues are resolved in later releases. See references for individual vulnerability details...

Security update for golang-github-docker-libnetwork

This update for golang-github-docker-libnetwork fixes the following issue CVE-2026-2808: github.com/hashicorp/consul: unvalidated user-supplied file paths can lead to arbitrary file reads through the Vault Kubernetes authentication provider bsc1259566. Patch Instructions: To install this SUSE...

SUSE-SU-2026:2740-1 Security update for golang-github-docker-libnetwork

This update for golang-github-docker-libnetwork fixes the following issue - CVE-2026-2808: github.com/hashicorp/consul: unvalidated user-supplied file paths can lead to arbitrary file reads through the Vault Kubernetes authentication provider bsc1259566...

CLEANSTART-2026-LZ54652 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729 applied in versions: 1.7.0-r0, 1.7.1-r0

Multiple security vulnerabilities affect the vault-k8s package. These issues are resolved in later releases. See references for individual vulnerability details...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the the Vault Kubernetes Authentication Provider. An attacker can access sensitive files by specifying tokenpath configuration parameter to any file on the Consul server node that later returned as jwt data and sent t...

CLEANSTART-2026-OO14630 tar

Multiple security vulnerabilities affect the vault-k8s package. tar. See references for individual vulnerability details...

CLEANSTART-2026-HY43775 Within HostnameError

Multiple security vulnerabilities affect the vault-k8s package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2025-AZ51267 Security fixes for GHSA-qxp5-gwg8-xv66, GHSA-vvgc-356p-c3xw applied in versions: 1.7.0-r0

Multiple security vulnerabilities affect the vault-k8s-fips package. These issues are resolved in later releases. See references for individual GHSA details...

CLEANSTART-2025-US16386 Security fixes for GHSA-qxp5-gwg8-xv66, GHSA-vvgc-356p-c3xw applied in versions: 1.7.2-r0

Multiple security vulnerabilities affect the vault-k8s-fips package. These issues are resolved in later releases. See references for individual GHSA details...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: octo-sts, kube-vip, docker-credential-ecr-login, php-fpmexporter, gostatsd, confluent-common-docker, terraform-provider-time, vault-benchmark, k8sgpt-operator, cloud-provider-aws, dagdotdev, kubeflow-katib, newrelic-fluent-bit-output, mongodb-kubernetes-operator,...

GHSA-V6V8-XJ6M-XWQH vulnerabilities

Vulnerabilities for packages: rekor, zot, guac, flux-source-controller, flux-image-automation-controller, rabbitmq-messaging-topology-operator, bank-vaults, nuclei, chainctl, vault-csi-provider, kargo, rekor-fips, step-ca, kubevela, crossplane-provider-azure-authorization,...