@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators

Impact: @hulumi/policies versions before 1.3.2 only checked exact AWS IAM StringLike/StringEquals condition operator key

历史摘要 · 未重新核验 · GitHub Advisory

@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the adm

历史摘要 · 未重新核验 · GitHub Advisory

@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass

Impact: @hulumi/policies versions before 1.3.2 could accept spoofed SecureBucket parent evidence for HULUMI-H1, allowing

历史摘要 · 未重新核验 · GitHub Advisory

@hulumi/drift: Orphan reconciler accepted externally supplied execute plans

Impact: @hulumi/drift versions before 1.3.2 could accept externally supplied execute plans without sufficient provenance

历史摘要 · 未重新核验 · GitHub Advisory

@hulumi/baseline: CloudTrail selector tampering events were not fully detected

Impact: @hulumi/baseline versions before 1.3.2 could miss some CloudTrail event-selector tampering evidence, reducing co

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Stale Auth Cache After API Token Deletion

CVE-2026-46554

### Summary Deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cach

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Attachment Size Limit Bypass via Upload-by-URL

CVE-2026-46553

### Summary The upload-by-URL path did not enforce `NC_ATTACHMENT_FIELD_SIZE` against either the remote file's advertise

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Shared-base link access can invite arbitrary users as persistent base members

CVE-2026-46552

### Summary Shared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only th

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion

CVE-2026-46551

### Summary The `uploadViaURL` path in the v1/v2 attachment API did not enforce `NC_ATTACHMENT_FIELD_SIZE` against the

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags

CVE-2026-46550

### Summary The refresh-token cookie was set with `httpOnly: true` but missing both the `secure` flag and the `sameSite

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

CVE-2026-46549

### Summary The OAuth token strategy attached `oauth_scope` and `oauth_granted_resources` to the request user, but the

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)

CVE-2026-46548

### Summary The `request-filtering-agent` SSRF protection was non-functional in the four notification webhook plugins (

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

CVE-2026-46547

### Summary A reflected XSS vulnerability exists in the Page Leaving Warning page. The `ncRedirectUrl` and `ncBackUrl` q

历史摘要 · 未重新核验 · GitHub Advisory

MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement

CVE-2026-46519

## Summary `mcp-server-kubernetes` exposes three environment variables (`ALLOW_ONLY_READONLY_TOOLS`, `ALLOW_ONLY_NON_DE

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows

## Summary The `/api/v1/chatflows/apikey/:apikey` endpoint (whitelisted, accessible with API key auth only) returns all

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification

### Summary A Mass Assignment vulnerability in the PUT /api/v1/user endpoint allows authenticated users to directly modi

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

### Summary The TTS generation endpoint sets `Access-Control-Allow-Origin: *` as a hardcoded response header, independe

历史摘要 · 未重新核验 · GitHub Advisory

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

CVE-2026-46421

## Impact On April 29, 2026, compromised versions of `@cap-js/sqlite@2.2.2`, `@cap-js/postgres@2.2.2`, and `@cap-js/db-

历史摘要 · 未重新核验 · GitHub Advisory

@angular/platform-server: SSRF via Hostname Hijacking

CVE-2026-46417

### Impact A Server-Side Request Forgery (SSRF) vulnerability exists in `@angular/platform-server`. The issue stems fro

历史摘要 · 未重新核验 · GitHub Advisory

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

CVE-2026-46412

## Summary Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 m

历史摘要 · 未重新核验 · GitHub Advisory