CVE-2026-18830 Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...

CVE-2026-18830

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...

EUVD-2026-52819

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...

django-amazon-price-monitor (>=0.3.0b2, <=0.4.0), django-autoconfig (>=0.3.4, <=0.3.6) potentially affected by CVE-2026-15830 via django (1.9.0rc2)

django PYPI version 1.9.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-amazon-price-monitor =0.3.0b2, =0.3.4, =0.3.6 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

MAL-2026-11885 Malicious code in @servicetitan/lazy-module (npm)

npm/@servicetitan/lazy-module is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1780447841 TuxCare security update for aws/aws-sdk-php (1 CVE)

TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p2+tuxcare...

CLSA-2026-1771891822 TuxCare security update for aws-sdk (1 CVE)

TuxCare rebuilt aws-sdk to address 1 CVE. Fixed in 2.1693.0-tuxcare.1...

MAL-2026-11558 Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

PYSEC-2026-3549 AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

Summary The AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...

Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

Amazon Linux 2 : python-pyasn1, --advisory ALAS2-2026-3836 (ALAS-2026-3836)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3836 advisory. pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on...

Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2026-2037)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2037 advisory. NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source packageNOTE: depending on 7zip. Mark this version as fixed version.NOTE:...

Amazon Linux 2023 : pipewire, pipewire-alsa, pipewire-config-rates (ALAS2023-2026-2029)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2029 advisory. RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return. CVE-2026-14324 Multiple unbounded alloca calls in the PulseAudio protocol server. CVE-2026-14330 A...

Amazon Linux 2 : aws-nitro-enclaves-cli, --advisory ALAS2NITRO-ENCLAVES-2026-115 (ALASNITRO-ENCLAVES-2026-115)

The version of aws-nitro-enclaves-cli installed on the remote host is prior to 1.4.5-0. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-115 advisory. rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79,...

Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-2020)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2020 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...

Amazon Linux 2023 : python3-pyasn1, python3-pyasn1-modules (ALAS2023-2026-2000)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2000 advisory. pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound ...

Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3839 (ALAS-2026-3839)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3839 advisory. Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image...

Amazon Linux 2 : 389-ds-base, --advisory ALAS2-2026-3853 (ALAS-2026-3853)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3853 advisory. A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server389-ds-base. After a successful SASL bin...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

Amazon Linux 2 : glib2, --advisory ALAS2-2026-3850 (ALAS-2026-3850)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3850 advisory. A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in xdgmimemagicparsemagicline in the xdgmimemagic.c file ...