LambdaGuard

LambdaGuard AWS Lambdaは、Amazon Web Servicesが提供するイベント駆動型のサーバーレスコンピューティングプラットフォームです。イベントに応じてコードを実行し、そのコードに必要なコンピューティングリソースを自動的に管理するコンピューティングサービスです。 LambdaGuardは、AWS Lambdaの監査ツールであり、資産の可視性を高め、実用的な結果を提供するために設計されています。統計分析、AWSサービスの依存関係、セキュリティの観点からの設定チェックに関して、有意義な概要を提供します。 必要条件 Python 3.6+ Java...

CVE-2026-22008-AWS-Lambda-Layer-Injection-via-Shared-Layer-ARN

CVE-2026-22008 – 共有レイヤーARNを介したAWS Lambdaレイヤーインジェクション プログラムコード（Python） root@kitploit: deployvulnerablelambda.py - Lambda function using a layer from untrusted account import boto3 lambdaclient = boto3.client'lambda' Attacker publishes a public layer containing malicious code Victim function...

CVE

Control Tower Notification Enabler この cdk パッケージは、Lambda 関数と関連する IAM ロールをインストールし、その Lambda 関数を Control Tower の集約セキュリティ通知にサブスクライブします。Control Tower のルール違反（例: 一般公開されている S3 バケット）が発生した場合、Lambda は Webhook に通知を送信します。 前提条件 組織に対する管理者アクセス。これは、監査アカウントで Control Tower ロールを引き受けるために使用されます AWS CDK がインストールされていること...

CVE-2026-90513

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

DVFaaS-Damn-Vulnerable-Functions-as-a-Service

DVFaaS - 意図的に脆弱な関数サービス（Damn Vulnerable Functions as a Service） DHIY（デプロイして自分でハックする）プロジェクト。AWS Lambda 上で、ひどく安全でない関数群をデプロイして実行できます。 目的と対象読者 we45 では、Serverless Security、クラウド、モダンな Web スタックのセキュリティに関するトレーニングを数多く実施しています。...

CVE-2026-90513 simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

CVE-2026-90513

CVE-2026-90513 affects simalexan api-lambda-send-email-ses (up to commit bda6869aa81371d1e872242e74fe7d953edb818d ). The flaw resides in the SES.sendEmail function within the API Gateway Endpoint component (file template.yml ), where a missing authentication mechanism allows remote manipulation o...

EUVD-2026-76985

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

GHSA-PX8P-9VWX-VF98 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, librechat, tileserver-gl, lambda-nodejs, langfuse, langfuse-fips...

CVE-2026-45820 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, librechat, tileserver-gl, lambda-nodejs, langfuse, langfuse-fips...

CVE-2026-82802

A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to...

EUVD-2026-68607

A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to...

Astra Linux – Vulnerability in pillow

In Pillow’s PIL.ImageMath.eval before version 9.0.0, it was possible to evaluate arbitrary expressions, including those that used the Python exec method. A lambda expression could also be used...

CVE-2026-77415

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct...

CVE-2026-77810

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

CVE-2026-77810

CVE-2026-77810 is a code injection vulnerability in the Neptune connector of aws-athena-query-federation , caused by a Gremlin query passthrough . A user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying compute for the connector, result...

CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

EUVD-2026-64067

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

PT-2026-79440

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...