Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2025-3120 (ALAS-2025-3120)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300062.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3120 advisory. SSH Agent servers do not validate the size of messages when processing new identity requests, which m...

CVE-2025-65637 vulnerabilities

Vulnerabilities for packages: kpt, sonobuoy, gostatsd, kube-fluentd-operator, aws-flb-firehose, docker-credential-gcr, aws-flb-cloudwatch, hello-world-golang, kubeflow, newrelic-nri-statsd, smokescreen, aws-flb-kinesis, src-fingerprint, terraform-provider-google, go-discover, neuvector-dbgen,...

GHSA-4F99-4Q7P-P3GH vulnerabilities

Vulnerabilities for packages: kpt, sonobuoy, gostatsd, kube-fluentd-operator, aws-flb-firehose, docker-credential-gcr, aws-flb-cloudwatch, hello-world-golang, kubeflow, newrelic-nri-statsd, smokescreen, aws-flb-kinesis, src-fingerprint, terraform-provider-google, go-discover, neuvector-dbgen,...

GHSA-4F99-4Q7P-P3GH vulnerabilities

Vulnerabilities for packages: falcoctl-fips, kubeflow-fips, sonobuoy, smokescreen, gostatsd, prometheus-mongodb-exporter-fips, src-fingerprint, kpt, neuvector-dbgen-fips, hello-world-golang, src-fingerprint-fips, wavefront-collector-for-kubernetes, terraform-provider-google,...

CVE-2025-65637 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, kubeflow-fips, sonobuoy, smokescreen, gostatsd, prometheus-mongodb-exporter-fips, src-fingerprint, kpt, neuvector-dbgen-fips, hello-world-golang, src-fingerprint-fips, wavefront-collector-for-kubernetes, terraform-provider-google,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh-serving, sftpgo, kind, glow, kube-vip-cloud-provider, q, kubeflow-pipelines, nginx-prometheus-exporter, gke-gcloud-auth-plugin, go-jsonnet, supercronic, go-licenses, rancher-telemetry, tfsec, polaris, hey, nri-memcached, terraform-docs, nri-mongodb,...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-1224)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1224 advisory. go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2025-3037 (ALAS-2025-3037)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300059.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3037 advisory. go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065...

Medium: amazon-cloudwatch-agent

Issue Overview: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Affected Packages: amazon-cloudwatch-agent Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Co...

Medium: amazon-cloudwatch-agent

Issue Overview: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Affected Packages: amazon-cloudwatch-agent Issue Correction: Run dnf update amazon-cloudwatch-agent --releasever 2023.9.20251014 or dnf update --advisory ALAS2023-2025-1224...

EUVD-2022-7662

Malicious code in bioql PyPI...

EUVD-2022-4475

Malicious code in bioql PyPI...

EUVD-2024-45843

Malicious code in bioql PyPI...

CVE-2025-58057 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, wildfly, cassandra-reaper, docker-selenium, solr, logstash-input-http, trino, infinispan, selenium, keycloak, logstash-input-beats, flyway, cloudwatch-exporter, celeborn, apache-activemq-artemis, zipkin, tez, druid, wavefront-proxy,...

CVE-2025-58057 vulnerabilities

Vulnerabilities for packages: sonarqube, apicurio-registry, cloudwatch-exporter, camunda-zeebe, apache-hop, wavefront-proxy, infinispan, kafka, management-api-for-apache-cassandra-4.1, neo4j, knative-kafka-broker, trino, spark, cassandra, logstash-input-tcp, solr, flyway, elasticsearch-fips,...

GHSA-3P8M-J85Q-PGMJ vulnerabilities

Vulnerabilities for packages: sonarqube, apicurio-registry, cloudwatch-exporter, camunda-zeebe, apache-hop, wavefront-proxy, infinispan, kafka, management-api-for-apache-cassandra-4.1, neo4j, knative-kafka-broker, trino, spark, cassandra, logstash-input-tcp, solr, flyway, elasticsearch-fips,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: openfga, doppler-kubernetes-operator, prometheus-redis-exporter, restic, go-md2man, karma, opentelemetry-collector-contrib-fips, helm-fips, dex, kubernetes-csi-driver-nfs, minio-operator, neuvector-dbgen-fips, nvidia-nsight-compute-13.1, amazon-ssm-agent,...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2904)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300055.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2904 advisory. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus...

Medium: amazon-cloudwatch-agent

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

Medium: amazon-cloudwatch-agent

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...