Medium: vim

Issue Overview: Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault SEGV exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.007...

Important: amazon-efs-utils

Issue Overview: time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used...

Important: freerdp

Issue Overview: DoS via WINPRASSERT in rtsreadauthverifiernochecks NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4v4p-9v5x-hc93 CVE-2026-33952 DoS via WINPRASSERT in IMA ADPCM audio decoder dsp.c:331 NOTE:...

Important: python3.11

Issue Overview: The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open. CVE-2026-4519 Affected Packages:...

Medium: runc

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-1581)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1581 advisory. Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus- utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute...

Amazon Linux 2023 : yq (ALAS2023-2026-1582)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1582 advisory. The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially...

Amazon Linux 2023 : mod_security_crs (ALAS2023-2026-1562)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1562 advisory. Whitespace padding in filenames bypasses file upload extension checks NOTE: https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w CVE-2026-33691 Tenable has extracted the...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1584)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1584 advisory. When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore ma...

Amazon Linux 2023 : dovecot, dovecot-devel, dovecot-mysql (ALAS2023-2026-1570)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1570 advisory. Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2026-1547)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1547 advisory. A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. Thi...

Amazon Linux 2023 : below (ALAS2023-2026-1567)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1567 advisory. tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As par...

Command Injection

Overview aws-mcp is an AWS Model Context Protocol Server Affected versions of this package are vulnerable to Command Injection via improper validation of user-supplied input in the allowed commands process. An attacker can execute arbitrary system commands by supplying crafted input that is used ...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: syft, qemu-guesthelper, consul, regclient-fips, k8ssandra-client-fips, gh, prometheus-podman-exporter, cilium-envoy-fips, malcontent, grafana-operator-fips, nats, conftest-fips, mailpit-fips, jaeger, azure-aad-pod-identity-mic, cloudflared-fips, vendir-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: syft, qemu-guesthelper, consul, regclient-fips, k8ssandra-client-fips, gh, prometheus-podman-exporter, cilium-envoy-fips, malcontent, grafana-operator-fips, nats, conftest-fips, mailpit-fips, jaeger, azure-aad-pod-identity-mic, cloudflared-fips, vendir-fips,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: syft, qemu-guesthelper, consul, flannel-fips, yunikorn-k8shim, chaos-mesh, kyverno-policy-reporter-kyverno-plugin, x509-certificate-exporter, authservice, k8ssandra-client-fips, gh, prometheus-podman-exporter, terraform-provider-time-fips, spicedb-operator,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter-fips, syft, qemu-guesthelper, consul, flannel-fips, pvc-autoresizer-fips, chaos-mesh, kyverno-policy-reporter-kyverno-plugin, regclient-fips, yunikorn-k8shim, logstash-exporter-fips, rabbitmq-default-user-credential-updater,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: qemu-guesthelper, consul, rabbitmq-default-user-credential-updater, kubeflow-fips, gh, terraform-provider-time-fips, spicedb-operator, cilium-envoy-fips, aws-sigv4-proxy-fips, argo-events-fips, neuvector-dbgen, datadog-operator-fips, quic-go-fips, cfssl, nri-couchbas...

CVE-2026-5059 aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handlin...

CVE-2026-5059

CVE-2026-5059 – aws-mcp-server is a command-injection remote code execution vulnerability. The flaw occurs in how the server handles the allowed commands list, due to insufficient validation of a user-supplied string before it is used to perform a system call. This allows an unauthenticated attac...