PT-2026-85983

Package amazon-cloudwatch-agent version 1.300065.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

PT-2026-85850

Package amazon-k8s-cni-fips version 1.22.3-r1 fixes 1 vulnerabilities: ghsa-p77j-4mvh-x3m3...

EUVD-2026-57420

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

CVE-2026-19311

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

OPENSUSE-SU-2026:21574-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issue: Update to version 1.106.0. Security issues fixed: - CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed bsc1267794. Other...

SUSE-SU-2026:23234-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issue: Update to version 1.106.0. Security issues fixed: - CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed bsc1267794. Other...

PT-2026-71211

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

CVE-2026-19311: Undefined Behavior for Input to API

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

(Pwn2Own) Amazon Smart Plug Insecure Fallback Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The specific flaw exists within the distress beaconing process. The issue results from the device...

(Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability

This vulnerability allows network-adjacent attackers to bypass certificate validation for OTA updates on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of OTA updates. The issue results from...

(Pwn2Own) Amazon Smart Plug OTA Update Process Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of OTA updates. The issue results from the lack of proper...

CVE-2026-19642: Out-of-bounds Write

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version...

Authorization Bypass Through User-Controlled Key

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the SecretsManagerBackend and SystemsManagerParameterStoreBackend...

airflow-toolkit (0.13.3), airflow-tools (>=0.9.0, <=0.12.0) +4 more potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (>=9.0.0, <=9.30.0)

apache-airflow-providers-amazon PYPI version =9.0.0, =0.9.0, =0.0.1, =2.10.3, =0.0.1rc1, =2.10.7rc1, =2.10.11rc5 Source cves: CVE-2026-68872 Source advisory: SNYK:PYTHON-APACHEAIRFLOWPROVIDERSAMAZON-18609774...

flowui-project (>=0.0.1, <=0.0.13) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (4.0.0)

apache-airflow-providers-amazon PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - flowui-project =0.0.1, =0.0.13 Source cves: CVE-2026-68872 Source advisory: OSV:PYSEC-2026-3713...

example-pkg-naturalett (>=14.4.0, <=14.4.8) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (2.0.0)

apache-airflow-providers-amazon PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - example-pkg-naturalett =14.4.0, =14.4.8 Source cves: CVE-2026-68872 Source advisory:...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (3.2.0)

apache-airflow-providers-amazon PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-68872 Source advisory: OSV:PYSEC-2026-371...

airflow-aws-shared-secrets (>=0.0.1, <=0.0.5), airflow-tools (>=0.1.0, <=0.8.6) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (8.29.0)

apache-airflow-providers-amazon PYPI version 8.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-aws-shared-secrets =0.0.1, =0.1.0, =0.8.6 Source cves: CVE-2026-68872 Source advisory:...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (1.4.0)

apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2026-688...

airflow-poetry-test (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (3.4.0)

apache-airflow-providers-amazon PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-poetry-test =0.1.0, =0.1.2 Source cves: CVE-2026-68872 Source advisory: OSV:PYSEC-2026-371...