CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

5215 matches found

OSV•added 2026/07/13 3:02 p.m.•15 views

PYSEC-2026-2387 AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

5.7CVSS6.1AI score0.00096EPSS

SaveExploits0References9

OSV•added 2026/07/13 2:36 p.m.•9 views

PYSEC-2026-2363 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

5.4CVSS6AI score0.00359EPSS

SaveExploits1References8

Cvelist•added 2026/07/12 10:15 p.m.•41 views

CVE-2026-15508 Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function buildtargeturl of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extractedpathandquery can lead to server-side request forgery...

6.5CVSS0.00206EPSS

SaveExploits0References5

CVE•added 2026/07/12 10:15 p.m.•43 views

CVE-2026-15508

Helicone ai-gateway (up to 0.2.0-beta.30) is affected. The flaw is in the AWS Metadata Service component, specifically the build_target_url function in ai-gateway/src/dispatcher/service.rs, where manipulating extracted_path_and_query can trigger server-side request forgery. Exploitation is possib...

6.5CVSS6.3AI score0.00206EPSS

SaveExploits0References5

Positive Technologies•added 2026/07/12 12:00 a.m.•21 views

PT-2026-57575

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build target url of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extracted path and query can lead to server-side request...

6.5CVSS6.3AI score0.00206EPSS

SaveExploits0References7

Chainguard•added 2026/07/10 8:20 p.m.•31 views

GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities

Vulnerabilities for packages: falcoctl, kubescape, kubescape-server, ratify-fips, spire-server-fips, policy-controller-fips, kyverno-notation-aws, crossplane-fips, zarf-fips, tkn-fips, tekton-chains-fips, cloudbeat-fips, kyverno, trivy-fips, neuvector-sigstore-interface, tkn, image-factory-fips,...

5.2AI score

SaveExploits0

Chainguard•added 2026/07/09 8:30 p.m.•31 views

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesisanalyticsv2-fips, crossplane-provider-aws-kinesisanalyticsv2, crossplane-provider-aws-codestarconnections, gatus-fips, secrets-store-csi-driver-provider-azure, aws-load-balancer-controller-fips, crossplane-provider-azure-securityinsight...

5.2AI score

SaveExploits0

Wolfi•added 2026/07/09 8:23 p.m.•53 views

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: portieris, kube-fluentd-operator, vault-k8s, supercronic, sftpgo-plugin-auth, kapp-controller, terragrunt, delve, kuberlr, ferretdb, secrets-store-csi-driver-provider-gcp, knative-client, victoriametrics-cluster, vexctl, azurefile-csi, sops, nri-discovery-kubernetes,...

5.2AI score

SaveExploits0

Chainguard•added 2026/07/09 2:17 p.m.•22 views

CVE-2026-31589 vulnerabilities

Vulnerabilities for packages: linux-aws...

9.8CVSS7.2AI score0.00444EPSS

SaveExploits0

Chainguard•added 2026/07/09 2:25 a.m.•22 views

CVE-2026-42505 vulnerabilities

5.3CVSS8.5AI score0.00382EPSS

SaveExploits0

Chainguard•added 2026/07/08 2:17 a.m.•23 views

GHSA-QCXP-RJ5J-4RR9 vulnerabilities