GHSA-G8CF-RCJF-C8CF vulnerabilities

Vulnerabilities for packages: timoni, crossplane-provider-aws-cloudfront, crossplane-provider-aws-route53, crossplane-provider-aws-kinesis, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, crossplane-provider-azure-managedidentity, grafana, kubevela,...

GHSA-RJ39-CV6W-8WV7 vulnerabilities

Vulnerabilities for packages: timoni, crossplane-provider-aws-cloudfront, crossplane-provider-aws-route53, crossplane-provider-aws-kinesis, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, crossplane-provider-azure-managedidentity, grafana, kubevela,...

GHSA-VRCC-3CH7-HPPW vulnerabilities

Vulnerabilities for packages: timoni, crossplane-provider-aws-cloudfront, crossplane-provider-aws-route53, crossplane-provider-aws-kinesis, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, crossplane-provider-azure-managedidentity, grafana, kubevela,...

CVE-2026-100347 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-route53, crossplane-provider-aws-kinesis, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, crossplane-provider-azure-managedidentity, grafana, kubevela,...

CVE-2026-86409

A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 AWS SigV4 authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled...

Cloud-Penetration-Testing-Umar3P

Cloud Pentesting Cloud penetration testing assesses the secur...

amoniak (1.0.2), aws-scripts (>=0.0.20, <=0.1.12) +6 more potentially affected by CVE-2026-96749 via pymongo (2.9.5)

pymongo PYPI version 2.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - amoniak 1.0.2 - aws-scripts =0.0.20, =0.4.2, =2.0.3, =0.1.3, =2.0.0, =2.3.0 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

amoniak (1.0.2), aws-scripts (>=0.0.20, <=0.1.12) +6 more potentially affected by CVE-2026-88029 via pymongo (2.9.5)

pymongo PYPI version 2.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - amoniak 1.0.2 - aws-scripts =0.0.20, =0.4.2, =2.0.3, =0.1.3, =2.0.0, =2.3.0 Source cves: CVE-2026-88029 Source advisory: OSV:PYSEC-2026-4294...

EUVD-2026-101751

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

curl: curl: stale SigV4 headers sent unintended

A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 AWS SigV4 authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled...

PT-2026-114182

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.79.0 Description An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP clie...

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

SUSE-SU-2026:4628-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

Amazon Linux 2 : awscli (ALAS-2026-3966)

The version of awscli installed on the remote host is prior to 1.18.147-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3966 advisory. Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has...

matano

Lago de datos de seguridad de código abierto para AWS Matano Open Source Security data lake es un lago de datos de seguridad nativo en la nube de código abierto, construido para equipos de seguridad en AWS. !NOTE Matano ofrece un SIEM en la nube comercial gestionado para una plataforma completa d...

lowkey

Agentes de Codificación de IA Auto-Alojados en AWS — OpenClaw, Claude Code, Codex, Kiro, NemoClaw, Hermes ▶️ Mira el tutorial completo en YouTube 📝 Lee el artículo del blog: "Le di a mi agente su propia cuenta de AWS" TL;DR — despliega Lowkey: curl -sfL install.lowkey.run | bash Funciona en bash ,...

metahub

MetaHub es una herramienta automatizada de enriquecimiento contextual de hallazgos de seguridad y evaluación de impacto para la gestión de vulnerabilidades. Puede usarla con AWS Security Hub o cualquier escáner de seguridad compatible con ASFF. Deje de depender de severidades inútiles y cambie a...

cloud

Cloud Monitoreando el Panorama de la Nube Nuestra misión con este proyecto es ofrecer un mapa siempre actualizado y de libre acceso del panorama de la nube para cada uno de los principales proveedores de servicios en la nube. Decidimos comenzar recolectando datos de certificados SSL de máquinas A...