Critical: rclone

Issue Overview: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /remote:path/object. The remote value is parsed from th...

CVE-2026-13762: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

CVE-2026-39395 vulnerabilities

Vulnerabilities for packages: trivy-operator-fips, ratify, ratify-fips, slsa-verifier, kyverno-fips, kyverno-notation-aws, chainctl-fips, policy-controller-fips, cloudbeat, teleport, trivy-operator, aactl, cloudbeat-fips, commercial-kyverno, chainctl, crossplane, ko-fips, zot, trivy,...

GHSA-W6C6-C85G-MMV6 vulnerabilities

Vulnerabilities for packages: trivy-operator-fips, ratify, ratify-fips, slsa-verifier, kyverno-fips, kyverno-notation-aws, chainctl-fips, policy-controller-fips, cloudbeat, teleport, trivy-operator, aactl, cloudbeat-fips, commercial-kyverno, chainctl, crossplane, ko-fips, zot, trivy,...

Towards Improved Anomaly Detection for Cloud Cybersecurity Via Graph Neural Networks

Detecting security threats in an organization's cloud computing environment has become necessary due to the increased reliance on cloud infrastructure. Logging of all cloud computing events enables investigation into any incidents after they are detected. Automated detection of threats using the...

EUVD-2026-32861

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM...

EUVD-2026-39912

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require...

CVE-2026-50136

Budibase prior to version 3.39.3 exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The /api/attachments/:datasourceId/url route is protected only by recaptcha, allowing a caller with workspace and S3 datasource IDs t...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-backup, crossplane-provider-aws-vpc-fips, pulumi, external-secrets-operator-fips, slsa-verifier, crossplane-provider-azure-relay, chainctl-fips, consul, kube-arangodb-fips, falcoctl-fips, crossplane-provider-aws-macie2-fips,...

GHSA-XV9W-7V6Q-HPJH fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

The fluent-plugin-s3 plugin specifically the ins3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limit...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the ins3 process. An attacker can cause excessive memory consumption by uploading a highly compressed file that decompresses to a large size, leading to resource exhaustion and...

MAL-2026-6522 Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e43e5a418541bb3e485010eba536ecc9f1483dba866af53ff4a760684409213 Package's main entry dist/index.cjs unconditionally requires dist/shai-hulud.js at module load. On require, the code harvests installer secrets —...

Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and Amazon Q does the rest. Amazon has patched it. Tracked as CVE-2026-12957 CVSS 8.5, the bug sat in...

MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension

By automatically loading MCP servers from workspace files, Amazon Q enabled attackers to execute code and access sensitive cloud environments...

PT-2026-53006

The fluent-plugin-s3 plugin specifically the in s3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limi...

GO-2026-5353 Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure in github.com/aws/amazon-ecs-agent

Amazon ECS Container Agent Windows is vulnerable to Information Disclosure in github.com/aws/amazon-ecs-agent...

autoqasm (0.1.1), mpqp (>=0.2.0, <=0.5.0) +3 more potentially affected by CVE-2026-9291 via amazon-braket-sdk (>=1.11.1, <=1.107.0)

amazon-braket-sdk PYPI version =1.11.1, =0.2.0, =0.14.0, =0.0.11.dev1, =0.1.0, =0.1.3 Source cves: CVE-2026-9291 Source advisory: OSV:GHSA-G697-2XRC-GC46...

autoqasm (0.1.1), mpqp (>=0.2.0, <=0.5.0) +3 more potentially affected by CVE-2026-9291 via amazon-braket-sdk (>=1.11.1, <=1.107.0)

amazon-braket-sdk PYPI version =1.11.1, =0.2.0, =0.14.0, =0.0.11.dev1, =0.1.0, =0.1.3 Source cves: CVE-2026-9291 Source advisory: GHSA-G697-2XRC-GC46...

fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

"The fluent-plugin-s3 plugin specifically the ins3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limi...

MAL-2026-6419 Malicious code in leo-cache (npm)

The leo-cache npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...