16984 matches found
jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-97679 via lfx (>=1.10.0, <=1.12.0.dev10)
lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...
jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-101329 via lfx (>=1.10.0, <=1.12.0.dev10)
lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...
jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-103360 via lfx (>=1.10.0, <=1.12.0.dev10)
lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...
jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +20 more potentially affected by CVE-2026-104334 via lfx (>=1.10.0, <=1.12.0.dev10)
lfx PYPI version =1.10.0, =1.10.0, =1.8.0rc0, =0.10.0rc0, =1.12.0.dev10 - lfx-amazon 0.1.5 - lfx-anthropic 0.1.6 - lfx-arxiv 0.1.4 - lfx-bundles 1.1.19 - lfx-cohere 0.1.2 - lfx-datastax 0.1.7 - lfx-docling 0.1.5 - lfx-duckduckgo 0.1.4 - lfx-empiriolabs 0.1.2 - lfx-exa 0.1.2 - lfx-firecrawl 0.1.2 ...
CVE-2026-105811
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambdahooks/README.md , available with QnABot on AWS versions 7.0.0 through 7.4.5,...
CVE-2026-105812
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...
CVE-2026-106032
Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...
CVE-2026-106032
Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...
CVE-2026-106032 Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import
Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...
EUVD-2026-94002
Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...
CVE-2026-106032
The Amazon Bedrock AgentCore Starter Toolkit is vulnerable to Server-Side Request Forgery (SSRF) and local file read in versions prior to 0.3.14 . The root cause is unrestricted external OpenAPI reference resolution during the processing of the agent import functionality. An authenticated remote ...
CVE-2026-105812
The Amazon Bedrock AgentCore Starter Toolkit before version 0.3.14 is vulnerable to a code injection flaw (CWE-94) within its agent import functionality. The root cause is the lack of safe literal encoding for configuration values when generating Python source code. An authenticated same-account ...
CVE-2026-105812
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...
CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...
EUVD-2026-94001
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...
CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...
CVE-2026-105811
The QnABot on AWS (versions 7.0.0 through 7.4.5) contains an authorization bypass vulnerability in the optional Amazon Q Business Lambda hook sample (q-business-lambda-hook). This issue stems from a user-controlled key and could allow an authenticated remote user to read arbitrary Amazon S3 objec...
CVE-2026-105811 Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambdahooks/README.md , available with QnABot on AWS versions 7.0.0 through 7.4.5,...
CVE-2026-105811 Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambdahooks/README.md , available with QnABot on AWS versions 7.0.0 through 7.4.5,...
EUVD-2026-93985
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambdahooks/README.md , available with QnABot on AWS versions 7.0.0 through 7.4.5,...