CVE-2026-7461: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a...

CVE-2026-4048 OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process...

Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2026-101 (ALASECS-2026-101)

"The version of ecs-init installed on the remote host is prior to 1.102.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-101 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Un...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: atlantis, rancher-helm, envconsul, commercial-grafana, kube-arangodb-fips, knative-serving-fips, wal-g, tigera-operator, cloudbeat, cloudbeat-fips, rclone-fips, prometheus-mongodb-exporter, conftest-fips, image-factory, kpt, rancher-machine, caddy, knative-operator,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: atlantis, rancher-helm, envconsul, commercial-grafana, kube-arangodb-fips, knative-serving-fips, wal-g, tigera-operator, cloudbeat, cloudbeat-fips, rclone-fips, prometheus-mongodb-exporter, conftest-fips, image-factory, kpt, rancher-machine, caddy, knative-operator,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: atlantis, aws-s3-controller, nri-redis, rancher-helm, aws-node-termination-handler, karma-fips, minio-object-browser-fips, conjur-cli, commercial-grafana, envconsul, knative-kafka-broker-fips, knative-serving-fips, kube-arangodb-fips, mc-fips, pvc-autoresizer, stern,...

powerdns-recursor -- vulnerabilities

PowerDNS Team reports: CVE-2026-3361: ZoneToCache can poison the cache CVE-2026-40012: Information about ECS zero scoped answers might leak to clients that use a specific ECS CVE-2026-42005: Unbounded resource consumption in internal webserver CVE-2026-42387: Insufficient input validation in...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2026-1532)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1532 advisory. Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC Role-Based Access Control filter contains a logic vulnerability in how it...

Amazon Linux 2 : ecs-service-connect-agent, --advisory ALAS2ECS-2026-100 (ALASECS-2026-100)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.34.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-100 advisory. Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and...

EulerOS Virtualization 2.12.1 : unbound (EulerOS-SA-2026-1467)

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: atlantis, rancher-helm, bento-fips, karma-fips, minio-object-browser-fips, sops-fips, kube-arangodb-fips, mc-fips, wal-g, tigera-operator, cloudbeat, cloudbeat-fips, ceph-csi-operator-fips, mc, terraform-provider-google, crossplane-aws-provider,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: atlantis, aws-s3-controller, nri-kubernetes, nri-redis, rancher-helm, bento-fips, karma-fips, minio-object-browser-fips, nri-jmx, conjur-cli, kube-arangodb-fips, mc-fips, pvc-autoresizer, knative-serving-fips, sops-fips, stern, wal-g, tigera-operator, cloudbeat,...

Medium: ecs-init

Issue Overview: The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content. CVE-2025-47911 The html.Parse function in golang.org/x/net/html has an...

Medium: containerd

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2026-097 (ALASECS-2026-097)

The version of ecs-init installed on the remote host is prior to 1.101.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-097 advisory. The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, whi...

Medium: oci-add-hooks

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

Amazon Linux 2023 : ecs-init (ALAS2023-2026-1443)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1443 advisory. The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially...

Medium: ecs-init

Issue Overview: The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content. CVE-2025-47911 The html.Parse function in golang.org/x/net/html has an...

CVE-2026-1922 The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ecs-list-events shortcode message attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-1922 The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ecs-list-events shortcode message attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied...