aws__aws-sdk-java_CVE-2022-31159_1-12-2600

AWS SDK for Java The AWS SDK for Java enables Java developers to easily work with Amazon Web Servicesaws and build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. See the AWS SDK for Java 2.xaws-sdk-for-java-2x for how to get started. In Maintenance Mode as of July 3...

CVE-2026-106493

A flaw was found in Backstage. Cloud storage catalog providers do not sufficiently validate object paths. An attacker with permissions to create or rename objects in a configured cloud storage source, such as Amazon Web Services AWS S3 or Azure Blob Storage, can cause catalog descriptors to be re...

EUVD-2026-38488

Language Servers for AWS Vulnerable to Arbitrary Code Execution...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible’s amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to exploit the issue, as the module handles the parameter insecurely, resulting in the password being leaked in the logs...

CVE-2026-85012: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...

PYSEC-2026-3627 AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

RHEA-2025:4438 Red Hat Enhancement Advisory: Red Hat OpenShift Service on AWS 1.0 enhancements

Bulletin has no description...

GHSA-HQVF-45JJ-MCCQ AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

CVE-2026-18954

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

MAL-2026-13346 Malicious code in hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013 On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory...

Malicious code in aws-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7 Package aws-sdk-v4 impersonates @aws-sdk/client-s3 and, on require of index.js, JSON-stringifies process.env together with hostname, username, home...

CVE-2026-17578 Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...

CVE-2026-18830

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...

CVE-2026-18830 Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...

MAL-2026-11885 Malicious code in @servicetitan/lazy-module (npm)

npm/@servicetitan/lazy-module is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1780447841 TuxCare security update for aws/aws-sdk-php (1 CVE)

TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p2+tuxcare...

CLSA-2026-1771891822 TuxCare security update for aws-sdk (1 CVE)

TuxCare rebuilt aws-sdk to address 1 CVE. Fixed in 2.1693.0-tuxcare.1...

PYSEC-2026-3549 AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

Summary The AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...