Strapi Versions <=4.5.6 - Authentication Bypass

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that...

EUVD-2026-64067

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

CVE-2026-32637 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-gcp-fips, velero-plugin-for-gcp, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-microsoft-azure, velero-plugin-for-aws, velero-plugin-for-aws-fips...

CVE-2026-32637 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-aws...

GHSA-J2G6-362Q-6QC6 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-aws...

PT-2026-79440

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

GO-2026-6093 vulnerabilities

Vulnerabilities for packages: localstack...

EUVD-2026-63585

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery

The Ray Dashboard API is affected by a Server-Side Request Forgery SSRF vulnerability in the url parameter of the /logproxy API endpoint. The API does not perform sufficient input validation within the affected parameter and any HTTP or HTTPS URLs are accepted as valid. id: CVE-2023-48023 info:...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-glue-fips, crossplane-provider-aws-dax-fips, crossplane-provider-aws-kms-fips, crossplane-provider-aws-cloudfront, crossplane-provider-aws-configservice, crossplane-provider-aws-opensearch-fips, crossplane-provider-aws-workspaces,...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-glue-fips, crossplane-provider-aws-dax-fips, crossplane-provider-aws-kms-fips, crossplane-provider-aws-cloudfront, crossplane-provider-aws-configservice, crossplane-provider-aws-opensearch-fips, crossplane-provider-aws-workspaces,...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, crossplane-provider-aws-eks, crossplane-provider-aws-sns, crossplane-provider-aws-ec2, nuclei, crossplane-provider-aws-elasticache, crossplane-provider-aws-firehose, crossplane-provider-azure-storage, grafana,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, cluster-api-helm-controller, argocd-image-updater, kubernetes-csi-external-resizer, cloud-provider-vsphere, metallb, fluent-operator, rancher-agent, helm-operator, spicedb-operator, cluster-api-ipam-provider-in-cluster, emissary,...

EUVD-2026-62941

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user...

CVE-2026-76376

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user...

GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

CVE-2026-76376 Information Disclosure through Action Parameters in AWS IAM app for Splunk SOAR

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user...

CVE-2026-76376

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR , a user with permission to run actions can expose sensitive AWS credentials in cleartext through the user interface. The root cause is that the affected action parameter is not marked as a password , so it is not masked when displayed. T...

CVE-2026-18140

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

Linux Distros Unpatched Vulnerability : CVE-2026-18140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every...