CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526

The CVE-2026-42526 vulnerability affects apache-airflow-providers-amazon backends for AWS Secrets Manager and SSM Parameter Store prior to 9.28.0. The team-scoping logic could resolve a conn_id containing a slash (for example a_team/conn) to the same path as another team’s secret when the caller ...

PT-2026-42004

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.28.0 Description In the AWS Secrets Manager and SSM Parameter Store secrets backends, the team-scoping logic could resolve a conn id containing a / for example, "my team/conn" to the same pat...

OPENSUSE-SU-2026:10765-1 amazon-ssm-agent-3.3.4268.0-2.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4268.0-2.1 package on the GA media of openSUSE Tumbleweed...

Deserialization of Untrusted Data

Overview mamba-ssm is a Mamba state-space model Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the frompretrained process. An attacker can execute arbitrary code by publishing a malicious model repository on HuggingFace Hub and having a victim load a mode...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: kargo, argo-events-fips, upwind-agent, skaffold-fips, trufflehog-fips, trivy-operator, argo-cd-fips, packer-fips, amazon-ssm-agent, chainctl-fips, argo-workflows-fips, mapotf-fips, k9s-fips, argocd-image-updater, syft-fips, rancher-fleet-fips, cerbos, chainctl,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: dive, crane, kargo, net-kourier, weaviate, envconsul-fips, cloud-provider-azure-fips, image-factory, cluster-autoscaler, tigera-operator, amazon-ecs-cni-plugins, amazon-ecs-agent, helm-fips, flux-helm-controller-fips, tekton-chains-fips, gitlab-rails-ce-fips, cilium,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: dive, crane, kargo, net-kourier, weaviate, envconsul-fips, cloud-provider-azure-fips, image-factory, cluster-autoscaler, tigera-operator, amazon-ecs-cni-plugins, amazon-ecs-agent, helm-fips, flux-helm-controller-fips, tekton-chains-fips, gitlab-rails-ce-fips, cilium,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ssm, dive, podinfo-fips, authservice, crossplane-provider-aws-wafv2, spilo, thanos-receive-controller-fips, cortex, terraform-provider-databricks, crane, fleet-server-fips, kargo, argo-events-fips, cloud-sql-proxy-fips, net-kourier,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ssm, terraform-provider-databricks, weaviate, envconsul-fips, cluster-autoscaler, kubescape-http-request-fips, hugo-extended, amazon-ecs-cni-plugins, aws-application-networking-k8s, cilium, prometheus-process-exporter,...

CVE-2026-31271

CVE-2026-31271 concerns megagao production_ssm v1.0, where the insert() function in UserController.java lacks authentication checks, enabling unauthenticated attackers to access the /user/insert endpoint and create super administrator accounts. This authorization bypass could lead to full system ...

OPENSUSE-SU-2026:10486-1 amazon-ssm-agent-3.3.4121.0-1.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4121.0-1.1 package on the GA media of openSUSE Tumbleweed...

Important: amazon-ssm-agent

Issue Overview: cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Affected Packages: amazon-ssm-agent Issue Correction: Run dnf update amazon-ssm-agent --releasever 2023.10.20260330 or d...

Important: amazon-ssm-agent

Issue Overview: cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Affected Packages: amazon-ssm-agent Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this...

Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2026-3207 (ALAS-2026-3207)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.3883.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3207 advisory. cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected...

openSUSE 16 Security Update : amazon-ssm-agent (openSUSE-SU-2026:20351-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20351-1 advisory. - CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or signing request bsc1253611. Tenab...

Security update for amazon-ssm-agent (important)

openSUSE security update: security update for amazon-ssm-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20351-1 Rating: important References: bsc1253611 Cross-References: CVE-2025-47913 CVSS scores: CVE-2025-47913 SUSE : 7.5...

OPENSUSE-SU-2026:20351-1 Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: - CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or signing request bsc1253611...

CVE-2026-27661

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application leaks confidential information in metadata, and files such as information on contributors and email address, on SSM Server...