[SECURITY] Fedora 45 Update: rust-reqsign-aws-core-3.2.0-1.fc45

Shared AWS credential and request canonicalization support for reqsign...

PT-2026-91736

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description An incomplete security scanner blocklist allows attackers to execute arbitrary Python code with root privileges UID=0 on the server by submitting components that import socket or urlli...

CVE-2026-12944: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

Malicious code in chai-as-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90afdde9240783f1f869b875b7967490cf579e1bae0986861498f8c98c0d973 The package advertises itself as a logger README and type definitions copied wholesale from pinojs/pino but its exported middleware is a no-op that...

aws-credential-process (0.20.0), aws-session-daemon (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2026-40947 via yubikey-manager (>=5.0.0, <=5.1.1)

yubikey-manager PYPI version =5.0.0, =0.1.0, =1.0.0, =1.6.6 Source cves: CVE-2026-40947 Source advisory: SNYK:PYTHON-YUBIKEYMANAGER-16325204...

CVE-2026-35022

Rejected reason: This CVE ID has been rejected by its CVE Numbering Authority CNA. It was determined that the -p flag behavior is documented in Anthropic's claude -h output with an explicit warning that non-interactive mode should only be used in trusted directories, making this intended and...

PT-2026-30708

Name of the Vulnerable Software and Affected Versions Anthropic Claude Code CLI and Claude Agent SDK affected versions not specified Description Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection issue in authentication helper execution. Helper configuration values are...

CVE-2025-63604: Improper Neutralization of Special Elements used in a Command

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...