GHSA-gfp8-mp24-5vxg
NoneCVSS
—
EPSS
—
Published
May 21, 2026
CISA due date
—
The record
@hulumi/baseline: CloudTrail selector tampering events were not fully detected
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hulumi/baseline | 0 | 1.3.2 |
Related vulnerabilities
- GHSA-cj8g-prcm-mfg5 @hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security… Also affects @hulumi/baseline
- GHSA-2mxr-p26x-mj73 @hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened Also affects @hulumi/baseline
- CVE-2020-37268 Print Assumptions does not report that a definition was produced while universe checking… CWE-778
- CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0… CWE-778
- CVE-2026-32693 In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is… CWE-778
- CVE-2025-52644 HCL AION is affected by a vulnerability where certain user actions are not adequately… CWE-778
- CVE-2026-25598 Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. CWE-778
- GHSA-cpmj-h4f6-r6pq Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and… CWE-778