CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526

The apache-airflow-providers-amazon package (prior to version 9.28.0 ) contains a vulnerability in its AWS Secrets Manager and SSM Parameter Store backends. The team-scoping logic could incorrectly resolve a conn_id containing a forward slash (e.g., "my_team/conn") to a path belonging to a differ...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

PT-2026-42004

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.28.0 Description In the AWS Secrets Manager and SSM Parameter Store secrets backends, the team-scoping logic could resolve a conn id containing a / for example, "my team/conn" to the same pat...

CVE-2026-42526: Incorrect Authorization

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

OPENSUSE-SU-2026:10765-1 amazon-ssm-agent-3.3.4268.0-2.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4268.0-2.1 package on the GA media of openSUSE Tumbleweed...

Deserialization of Untrusted Data

Overview mamba-ssm is a Mamba state-space model Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the frompretrained process. An attacker can execute arbitrary code by publishing a malicious model repository on HuggingFace Hub and having a victim load a mode...

bidirectional-mamba (0.2.0), capibara (2.1.8) +19 more potentially affected by CVE-2026-31239 via mamba-ssm (>=1.0.1, <=2.3.2.post1)

mamba-ssm PYPI version =1.0.1, =0.1.0, =0.0.0, =0.0.1a8, =0.1.2, =0.0.1, =1.0.0, =1.0.0, =0.3.0, =0.4.2 - ml-trainer-sdk 0.1.0 - nemo-eval 0.2.0rc0 - opensr-mamba 0.0.1 - oriongeno 1.0.2 and more Source cves: CVE-2026-31239 Source advisory: SNYK:PYTHON-MAMBASSM-17675163...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, grafana-alloy, src-fingerprint, packer-fips, argo-cd, guac, cloudbeat, gptscript, kubescape-server-fips, argo-workflows, gitlab-runner, kaniko, argocd-image-updater-fips, gitlab-rails-ce, rancher-fleet, google-osconfig-agent, kubevela,...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.4.0, <=0.8.0) +1 more potentially affected by CVE-2026-6967 via tough (>=0.9.0, <=0.13.0)

tough CARGO version =0.9.0, =0.1.0, =0.4.0, =0.5.0, =0.9.0 Source cves: CVE-2026-6967 Source advisory: OSV:GHSA-4V58-8P28-2RQ3...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.1.0, <=0.8.0) +1 more potentially affected by CVE-2026-6966 via tough (>=0.1.0, <=0.13.0)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0 Source cves: CVE-2026-6966 Source advisory: OSV:GHSA-8M7C-8M39-RV4X...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, neuvector-scanner-fips, flux-source-watcher, azuredisk-csi-fips, buildah, kubescape-server-fips, gitlab-rails-ce, aws-flb-firehose, mailpit, datadog-agent-fips, kube-arangodb-fips, dask-gateway, helm-exporter, localstack, rook-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, neuvector-scanner-fips, flux-source-watcher, azuredisk-csi-fips, buildah, kubescape-server-fips, gitlab-rails-ce, aws-flb-firehose, mailpit, datadog-agent-fips, kube-arangodb-fips, dask-gateway, helm-exporter, localstack, rook-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-fips, gatus, crossplane-aws-provider, newrelic-fluent-bit-output, speedtest-go, tetragon-fips, nrdot-collector-k8s-fips, bank-vaults-fips, neuvector-scanner-fips, crossplane-provider-aws-rds-fips, harbor-registry-fips, flux-source-watcher,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: nrdot-collector-k8s-fips, nri-couchbase, dcgm-exporter-fips, k8s-metacollector, sigstore-scaffolding-fips, manifest-tool, spire-controller-manager-fips, fq, dask-gateway, stakater-reloader-fips, prometheus-mysqld-exporter-fips, petname, bento, vt-cli,...

CVE-2026-31271

The megagao production_ssm v1.0 ERP system contains an authorization bypass vulnerability within the user addition functionality. Specifically, the insert() method in UserController.java fails to implement authentication checks, allowing unauthenticated attackers to create super administrator acc...

OPENSUSE-SU-2026:10486-1 amazon-ssm-agent-3.3.4121.0-1.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4121.0-1.1 package on the GA media of openSUSE Tumbleweed...

Important: amazon-ssm-agent

Issue Overview: cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Affected Packages: amazon-ssm-agent Issue Correction: Run dnf update amazon-ssm-agent --releasever 2023.10.20260330 or d...

Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2026-3207 (ALAS-2026-3207)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.3883.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3207 advisory. cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected...

Important: amazon-ssm-agent

Issue Overview: cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Affected Packages: amazon-ssm-agent Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this...