EUVD-2026-75623

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

EUVD-2026-75569

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a...

scrapy-amazon-robot-middleware3 (>=0.2.3, <=0.3.3), searchstax-simulator-crawler (>=0.0.1a22, <=0.0.1a23) potentially affected by CVE-2026-84366 via scrapy (1.3.3)

scrapy PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - scrapy-amazon-robot-middleware3 =0.2.3, =0.0.1a22, =0.0.1a23 Source cves: CVE-2026-84366 Source advisory: OSV:PYSEC-2026-3918...

CVE-2026-89049: Server-Side Request Forgery (SSRF)

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

Amazon Linux 2 : containerd (ALASECS-2026-136)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-136 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2026-118)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-118 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...

Important: containerd

Issue Overview: Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component...

CVE-2026-87912: Unverified Ownership

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a...

CVE-2026-85228: Integer Overflow or Wraparound

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

PT-2026-89507

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

CVE-2026-89049: Server-Side Request Forgery (SSRF)

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

Important: containerd

Issue Overview: Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-2130)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2130 advisory. An HTTP/2 denial of service vulnerability was found in nginx. Prior to the fix, there was no limit on the number of request headers a client could send. An attacker could seed the HPACK dynamic table...

Amazon Linux 2 : containerd (ALASDOCKER-2026-140)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-140 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-2131)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2131 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function...

EUVD-2026-75127

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911: Improper Neutralization of Special Elements used in an OS Command

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

Amazon Linux 2 : 389-ds-base (ALAS-2026-3909)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3909 advisory. A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL...

Amazon Linux 2 : ipa (ALAS-2026-3916)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3916 advisory. A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client ca...

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage...