477773 matches found
EUVD-2026-48725
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while...
CVE-2026-48035 Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while...
CVE-2026-48033 Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0...
CVE-2026-48033 Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0...
CVE-2026-48033
CVE-2026-48033 affects Hulumi before version 1.4.0. The vulnerability arises in the policy packs component: policy rules incorrectly trust URNs and can be bypassed when a developer names a resource with a trusted substring in the Pulumi-URN, allowing exemptions to be applied to resources that sho...
CVE-2026-48032 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0...
CVE-2026-48032 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0...
CVE-2026-48032
Hulumi (open-source toolkit for Pulumi) contains a vulnerability in the @hulumi/policies that affects IAM-role policy checks. Before v1.4.0, the policy validators incorrectly handled a JSON array in Principal.Federated, bypassing checks when a role trusts multiple OIDC providers. This could allow...
CVE-2026-48034
CVE-2026-48034 affects Hulumi components used with Pulumi. Before v1.4.0, a bypass exists in the decoy-sibling mechanism: an unhardened raw S3 bucket could appear compliant when paired with five hardening siblings that reference a different bucket, allowing a bypass of access controls. The issue ...
CVE-2026-48034 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...
CVE-2026-48034
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...
WordPress Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Yoast SEO versions = 28.0...
CVE-2026-66035
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...
EUVD-2026-42631
Open WebUI: /api/v1/channels/id/members exposes full user model including sensitive credentials...
EUVD-2026-42630
Open WebUI: Private channel messages can be disclosed through cross-channel thread parentid binding...
Use of Cache Containing Sensitive Information
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the getallmodels process due to improper cache key configuration, which causes permission-filtered model lists to be shared across users. An attacker can acces...
EUVD-2026-42625
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout...
EUVD-2026-42623
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers ydoc:awareness:update, ydoc:document:leave...