Login Request a demo
HU
Product
hulumi
by kerberosmansour · last CVE Aug 31, 2026
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 2High 6Medium 1Low 0
Severity
All severities9Critical2High6Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add hulumi to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-82859
9.8
1%
Aug 31
hulumi before v1.3.2 SCP Template Tag-on-Create Bypass
Affected: before 1.3.2
CVE-2026-82857
9.8
1%
Aug 31
hulumi before v1.3.2 Privilege Escalation via IAM Policy
Affected: before 1.3.2
CVE-2026-48034
8.5
0%
Jul 24
HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
Affected: < 1.4.0
CVE-2026-82862
8.4
0%
Aug 31
Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
Affected: before 1.3.2
CVE-2026-48036
8.4
1%
Jul 24
Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
Affected: < 1.4.0
CVE-2026-48033
8.4
0%
Jul 24
Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name
Affected: < 1.4.0
CVE-2026-48032
8.3
1%
Jul 24
Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers
Affected: < 1.4.0
CVE-2026-48035
7.1
0%
Jul 24
Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened
Affected: < 1.4.0
CVE-2026-48037
6.3
0%
Jul 24
Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
Affected: < 1.4.0
Showing 9