PT-2026-44049

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...

CVE-2026-38808

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...

CVE-2026-38808

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...

CVE-2026-38808

CVE-2026-38808 is a SQL Injection vulnerability affecting uzy-ssm-mall v1.1.0. The issue is reachable via the ProductMapper.xml and OrderUtil.java components, enabling a remote attacker to obtain sensitive information. The CVSS 3.1 vector indicates network access, low attack complexity, no privil...

CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526

The CVE-2026-42526 vulnerability affects apache-airflow-providers-amazon backends for AWS Secrets Manager and SSM Parameter Store prior to 9.28.0. The team-scoping logic could resolve a conn_id containing a slash (for example a_team/conn) to the same path as another team’s secret when the caller ...

PT-2026-42004

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.28.0 Description In the AWS Secrets Manager and SSM Parameter Store secrets backends, the team-scoping logic could resolve a conn id containing a / for example, "my team/conn" to the same pat...

OPENSUSE-SU-2026:10765-1 amazon-ssm-agent-3.3.4268.0-2.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4268.0-2.1 package on the GA media of openSUSE Tumbleweed...

Deserialization of Untrusted Data

Overview mamba-ssm is a Mamba state-space model Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the frompretrained process. An attacker can execute arbitrary code by publishing a malicious model repository on HuggingFace Hub and having a victim load a mode...

capibara (2.1.8), capibara-ent (>=0.1.0, <=0.1.1) +19 more potentially affected by CVE-2026-31239 via mamba-ssm (>=1.0.1, <=2.3.2.post1)

mamba-ssm PYPI version =1.0.1, =0.1.0, =0.0.0, =0.0.1a8, =0.1.2, =0.0.1, =1.0.0, =1.0.0, =0.3.0, =0.4.2 - ml-trainer-sdk 0.1.0 - nemo-eval 0.2.0rc0 - nemo-export-deploy 0.4.0 - opensr-mamba 0.0.1 - oriongeno 1.0.2 and more Source cves: CVE-2026-31239 Source advisory: SNYK:PYTHON-MAMBASSM-17675163...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: crossplane, chainloop-cli-fips, xeol, src-fingerprint-fips, terragrunt-fips, gitea, external-secrets-operator, grype-db, act, snyk-cli, cerbos, flux-image-automation-controller-fips, jfrog-cli, amazon-ssm-agent, argo-workflows-fips, kubevela-fips, mapotf,...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.4.0, <=0.8.0) +1 more potentially affected by CVE-2026-6967 via tough (>=0.9.0, <=0.13.0)

tough CARGO version =0.9.0, =0.1.0, =0.4.0, =0.5.0, =0.9.0 Source cves: CVE-2026-6967 Source advisory: OSV:GHSA-4V58-8P28-2RQ3...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.1.0, <=0.8.0) +1 more potentially affected by CVE-2026-6966 via tough (>=0.1.0, <=0.13.0)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0 Source cves: CVE-2026-6966 Source advisory: OSV:GHSA-8M7C-8M39-RV4X...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: beats-fips, spegel, xeol, rclone, external-dns, crane, gitlab-pages, flux-operator, external-secrets-operator, ko, act, helm-diff-fips, cloud-provider-azure-fips, tofu-controller-fips, omni-fips, apko, minio-fips, image-factory, newrelic-infrastructure-agent, atlas,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: beats-fips, spegel, xeol, rclone, external-dns, crane, gitlab-pages, flux-operator, external-secrets-operator, ko, act, helm-diff-fips, cloud-provider-azure-fips, tofu-controller-fips, omni-fips, apko, minio-fips, image-factory, newrelic-infrastructure-agent, atlas,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: beats-fips, spegel, step-issuer, aws-network-policy-agent, wavefront-collector-for-kubernetes, prometheus-nats-exporter-fips, mc, crossplane-provider-aws-elbv2, rancher-pushprox, aws-load-balancer-controller, xeol, dapr-fips, rclone, chronyexporter, external-dns,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: step-issuer, wavefront-collector-for-kubernetes, mc, external-dns, prometheus-process-exporter, chisel-fips, secrets-store-csi-driver, prometheus-elasticsearch-exporter-fips, bank-vaults-fips, nginx-prometheus-exporter-fips, tofu-controller-fips,...

CVE-2026-31271

CVE-2026-31271 concerns megagao production_ssm v1.0, where the insert() function in UserController.java lacks authentication checks, enabling unauthenticated attackers to access the /user/insert endpoint and create super administrator accounts. This authorization bypass could lead to full system ...