CVE-2026-32096 Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery SSRF vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to an...

EUVD-2026-11334

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1...

UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours

A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package last year to completely breach a victim's cloud environment within a span of 72 hours. The attack started with the theft of a developer's GitHub token, which the threat actor then use...

PT-2026-24814

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1...

CVE-2026-27138 vulnerabilities

Vulnerabilities for packages: pluto, nova-fips, aws-ebs-csi-driver, flux-image-reflector-controller, grafana-fips, stakater-reloader, victoriametrics-cluster-fips, flux-source-watcher, grafana-operator-fips, flux-fips, flux-notification-controller, victorialogs-fips, nova, temporal-fips,...

GHSA-PH5J-38MG-J6HP vulnerabilities

Vulnerabilities for packages: pluto, nova-fips, aws-ebs-csi-driver, flux-image-reflector-controller, grafana-fips, stakater-reloader, victoriametrics-cluster-fips, flux-source-watcher, grafana-operator-fips, flux-fips, flux-notification-controller, victorialogs-fips, nova, temporal-fips,...

GHSA-7HFW-R8QC-89V4 vulnerabilities

Vulnerabilities for packages: pluto, nova-fips, aws-ebs-csi-driver, flux-image-reflector-controller, grafana-fips, stakater-reloader, victoriametrics-cluster-fips, flux-source-watcher, grafana-operator-fips, flux-fips, flux-notification-controller, victorialogs-fips, nova, temporal-fips,...

CVE-2026-27137 vulnerabilities

Vulnerabilities for packages: pluto, nova-fips, aws-ebs-csi-driver, flux-image-reflector-controller, grafana-fips, stakater-reloader, victoriametrics-cluster-fips, flux-source-watcher, grafana-operator-fips, flux-fips, flux-notification-controller, victorialogs-fips, nova, temporal-fips,...

GO-2026-4591 Rancher Backup Operator pod's logs leak S3 tokens in github.com/rancher/backup-restore-operator

Rancher Backup Operator pod's logs leak S3 tokens in github.com/rancher/backup-restore-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloud-provider-azure-fips, temporal-server, crossplane-function-go-templating-fips, kubevela, aws-flb-kinesis, deck-fips, google-guest-agent, dcgm-exporter, helm-diff, sops-fips, crossplane-provider-aws-cloudformation, trivy-fips,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: apm-server-fips, vale, cloud-provider-azure-fips, temporal-server, crossplane-function-go-templating-fips, kubevela, aws-flb-kinesis, deck-fips, google-guest-agent, dcgm-exporter, helm-diff, sops-fips, crossplane-provider-aws-cloudformation, trivy-fips,...

Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...

GHSA-JW5G-F64P-6X78 Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...

CAMALEON CMS 路径遍历漏洞

CAMALEON CMS is a dynamic advanced content management system developed by Owen Peredo Diaz. Versions of Camaleon CMS prior to 2.9.0 and versions before f54a77e contained a path traversal vulnerability. This vulnerability stems from path traversal in the AWS S3 uploader implementation, which could...

CVE-2026-1776 Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read

Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...

Origin Validation Error

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Origin Validation Error in the SAML authentication process due to improper verification of the origin provided by the...

EUVD-2026-10318

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

EUVD-2026-10319

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-25604

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...