Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2026-2127)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2127 advisory. A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort...

Amazon Linux 2 : mod_auth_openidc (ALAS-2026-3920)

The version of modauthopenidc installed on the remote host is prior to 1.8.8-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3920 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2026-012)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2OPENSSL-SNAPSAFE-2026-012 advisory. Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2142)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2142 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to ma...

Amazon Linux 2 : wireshark (ALAS-2026-3905)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3905 advisory. C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76879 C12.22...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2026-2147)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2147 advisory. GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions an...

Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2026-009)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2LIBREOFFICE-2026-009 advisory. LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed wh...

Amazon Linux 2023 : libvirt, libvirt-client, libvirt-client-qemu (ALAS2023-2026-2139)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2139 advisory. A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check,...

Amazon Linux 2023 : runc (ALAS2023-2026-2138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2138 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2026-119)

The version of runc installed on the remote host is prior to 1.3.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-119 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-2132)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2132 advisory. A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream- dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes...

Amazon Linux 2 : openssl11 (ALAS-2026-3907)

The version of openssl11 installed on the remote host is prior to 1.1.1zi-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3907 advisory. Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes OpenSSL to buffer far...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2143 advisory. In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: always decrease sk refcount CVE-2026-46158 In the Linux kernel, the following vulnerability has been...

Important: kernel-livepatch-6.12.100-125.179

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.12.100-125.179 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: gstreamer1-plugins-good

Issue Overview: GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target mus...

Amazon Linux 2023 : openexr, openexr-devel, openexr-libs (ALAS2023-2026-2154)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2154 advisory. OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap...

Exploit for Use After Free in Arm Bifrost_Gpu_Kernel_Driver

AI-assisted project. This research, exploit development, a...

PT-2026-90052

Kiro IDE - Agent-Written Config - Data Exfiltration Attack Path - 1. Open a specially crafted untrusted repository in Kiro IDE. 2. The AI agent modifies the workspace configuration to point the Powers registry at an attacker-controlled endpoint. 3. Kiro asks the user to approve the change, but th...

CVE-2026-89332: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

CVE-2026-89090: Uncaught Exception

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...