CVE-2026-102552 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4....

CVE-2026-102551 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

CVE-2026-102551

Amazon FreeRTOS-Plus-TCP is vulnerable to improper verification of the source of a communication channel in its IPv6 Router Advertisement handler prior to version V4.4.2 . A remote third-party could exploit this by sending a crafted Router Advertisement to influence an endpoint's IPv6 default gat...

CVE-2026-102551 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

CVE-2026-102552: Improper Verification of Source of a Communication Channel

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4....

CVE-2026-102551: Improper Verification of Source of a Communication Channel

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

PT-2026-115997

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

PT-2026-115998

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4....

CVE-2026-110812

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...

CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...

CVE-2026-110812

The Amazon Neptune engine contains a vulnerability where deserialization of untrusted data in the Gremlin graph data import component allows an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials . To remediate this issue...

EUVD-2026-102193

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...

CVE-2026-110812: Deserialization of Untrusted Data

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...

PT-2026-115018

Name of the Vulnerable Software and Affected Versions Amazon Neptune engine versions prior to 1.5.0.0 Description Deserialization of untrusted data in the Gremlin graph data import component allows an authenticated remote actor with standard database permissions to execute arbitrary code and acce...

SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4662-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4662-1 advisory. This update for amazon-cloudwatch-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow ...

CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-110310

The Amazon S3 Encryption Client for .NET is vulnerable to an RSA PKCS#1 v1.5 padding oracle attack. A remote user capable of reading encrypted objects in an S3 bucket can force a padding downgrade by modifying an object's metadata to use the legacy PKCS#1 v1.5 scheme. This vulnerability allows th...

CVE-2026-110248

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...