EUVD-2026-95151

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

CVE-2026-107322

The Amazon Agent Plugins for AWS databases-on-aws plugin, in versions prior to 1.7.1 , is vulnerable to an OS command injection (CWE-184). An attacker can execute arbitrary operating system commands on the host running the helper by providing a crafted database command value within the agent cont...

CVE-2026-107322 OS command injection in Amazon Agent Plugins for AWS databases-on-aws

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

PT-2026-108142

Name of the Vulnerable Software and Affected Versions Amazon Agent Plugins for AWS databases-on-aws versions prior to 1.7.1 Description An incomplete list of disallowed inputs allows a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper. This...

CVE-2026-107322: Incomplete List of Disallowed Inputs

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

Security update for amazon-ecs-init (important)

openSUSE security update: security update for amazon-ecs-init ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22035-1 Rating: important References: bsc1276744 bsc1279231 bsc1279329 Cross-References: CVE-2026-41178 CVE-2026-84303 CVE-2026-84304 CVSS...

CVE-2026-107352

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

EUVD-2026-94615

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

CVE-2026-107352

The Amazon Athena engine version 3 contained a vulnerability due to missing authorization checks in request handling. This flaw could have allowed an authenticated user to read limited query metadata , specifically AWS account identifiers and SQL statement text , from other AWS accounts. The vuln...

CVE-2026-106493

A flaw was found in Backstage. Cloud storage catalog providers do not sufficiently validate object paths. An attacker with permissions to create or rename objects in a configured cloud storage source, such as Amazon Web Services AWS S3 or Azure Blob Storage, can cause catalog descriptors to be re...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-88962 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-93443 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-93448 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-93445 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-93674 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...

CVE-2026-107352: Missing Authorization

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

PT-2026-107672

Name of the Vulnerable Software and Affected Versions Amazon Athena engine version 3 Description Missing authorization checks in request handling could have allowed an authenticated user to read limited query metadata from other AWS accounts. The exposed information includes AWS account identifie...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-97678 via lfx (>=1.10.0, <=1.12.0.dev10)

lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...