CRITICAL: GHSA-q2f7-m237-v562: @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators — quick heads-up.

Packages: @hulumi/policies

https://npmscan.com/vulnerability/GHSA-q2f7-m237-v562

HIGH: GHSA-4xrh-5m3m-328w: @hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies — quick heads-up.

Packages: @hulumi/policies

https://npmscan.com/vulnerability/GHSA-4xrh-5m3m-328w

HIGH: GHSA-g43v-9x7q-83pq: @hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass — quick heads-up.

Packages: @hulumi/policies

https://npmscan.com/vulnerability/GHSA-g43v-9x7q-83pq

MEDIUM: GHSA-q8mj-m7cp-5q26 (CVE-2026-8723): qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set — quick heads-up.

Packages: qs

https://npmscan.com/vulnerability/GHSA-q8mj-m7cp-5q26

HIGH: GHSA-j3vx-cx2r-pvg8 (CVE-2026-46701): Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret — quick heads-up.

Packages: network-ai

https://npmscan.com/vulnerability/GHSA-j3vx-cx2r-pvg8

HIGH: GHSA-2ffm-hxrq-qqmm: @hulumi/drift: Orphan reconciler accepted externally supplied execute plans — quick heads-up.

Packages: @hulumi/drift

https://npmscan.com/vulnerability/GHSA-2ffm-hxrq-qqmm

MEDIUM: GHSA-gfp8-mp24-5vxg: @hulumi/baseline: CloudTrail selector tampering events were not fully detected — quick heads-up.

Packages: @hulumi/baseline

https://npmscan.com/vulnerability/GHSA-gfp8-mp24-5vxg

LOW: GHSA-f76x-f9vj-92jv (CVE-2026-46554): NocoDB: Stale Auth Cache After API Token Deletion — quick heads-up.

Packages: nocodb

https://npmscan.com/vulnerability/GHSA-f76x-f9vj-92jv

LOW: GHSA-8rwr-f68v-cvw6 (CVE-2026-46553): NocoDB: Attachment Size Limit Bypass via Upload-by-URL — quick heads-up.

Packages: nocodb

https://npmscan.com/vulnerability/GHSA-8rwr-f68v-cvw6

MEDIUM: GHSA-chqv-vrj7-qffp (CVE-2026-46552): NocoDB: Shared-base link access can invite arbitrary users as persistent base members — quick heads-up.

Packages: nocodb

https://npmscan.com/vulnerability/GHSA-chqv-vrj7-qffp

MEDIUM: GHSA-99vc-2jx2-688p (CVE-2026-46551): NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion — quick heads-up.

Packages: nocodb

https://npmscan.com/vulnerability/GHSA-99vc-2jx2-688p

MEDIUM: GHSA-f74w-272x-mqcv (CVE-2026-46550): NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags — quick heads-up.

Packages: nocodb

https://npmscan.com/vulnerability/GHSA-f74w-272x-mqcv