PT-2026-120795

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK V3 versions prior to 3.10.0 Amazon SageMaker Python SDK V2 versions prior to 2.257.3 Description Insufficient verification of the communication channel source within the default bucket function allows remote actors ...

OPENSUSE-SU-2026:12208-1 amazon-cloudwatch-agent-1.300073.0-3.1 on GA media

These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.0-3.1 package on the GA media of openSUSE Tumbleweed...

GO-2026-6686 vulnerabilities

Vulnerabilities for packages: k8s-image-swapper-fips, scorecard, newrelic-infrastructure-agent, runc-fips, umoci, chaos-mesh-fips, rke2-runtime-fips, rancher-agent, kubevirt-cdi-importer, packer-fips, rancher, zarf-fips, packer, cloudbeat-fips, ctop-fips, chaos-mesh, k3s, eks-distro-fips,...

SUSE-SU-2026:24265-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers bsc1279042. - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream...

OPENSUSE-SU-2026:22145-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers bsc1279042. - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream...

CVE-2026-98486

A flaw was found in the Linux kernel's Amazon Elastic Network Adapter ENA driver. When the driver encounters an error during device initialization, it fails to release an allocated Direct Memory Access DMA buffer. A local user capable of triggering repeated device probe failures could exploit thi...

domain-protect

OWASP Domain Protect - moved OWASP Domain Protect has moved to terraform-aws-domain-protect OWASP Domain Protect is now available as a Terraform Module See OWASP Domain Protect documentation including options for migration...

Cross-site Request Forgery (CSRF)

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the AWS auth manager SAML login flow, where login discards the AuthnRequest id...

CVE-2026-86467

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467

The Apache Airflow Amazon provider is vulnerable to a login-CSRF attack via the AWS auth manager 's SAML login flow. The vulnerability occurs because the login handler discards the AuthnRequest ID and the callback validates assertions without requiring a matching InResponseTo value. This allows a...

CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

EUVD-2026-104790

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

PT-2026-118101

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-135)

The version of kernel installed on the remote host is prior to 5.10.270-271.1109. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-135 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: rewind offset...

CVE-2026-102551

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

CVE-2026-102552

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4....

CVE-2026-102552

The Amazon FreeRTOS-Plus-TCP DNS resolver is vulnerable to improper verification of the source of a communication channel in versions prior to V4.4.2 . This flaw allows a remote third-party to perform a DNS cache poisoning attack by inserting a chosen address into the device's DNS cache via a for...

CVE-2026-102552 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4....