CVE-2026-68872 Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

CVE-2026-68872

The apache-airflow-providers-amazon package is vulnerable to an authorization bypass in its SecretsManagerBackend and SystemsManagerParameterStoreBackend lookup paths. In deployments using multi-team mode , a caller from one team can resolve a secret belonging to another team by providing an ID t...

CVE-2026-68872 Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

CVE-2026-68872 Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

PYSEC-2026-3627 AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

PT-2026-80679

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

PT-2026-69898

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.34.0 Description The AWS Systems Manager Parameter Store and Secrets Manager backends in the Amazon provider resolve a team-scoped Connection or Variable id through a team-agnostic lookup if...

CVE-2026-68872: Authorization Bypass Through User-Controlled Key

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

RHEA-2025:4438 Red Hat Enhancement Advisory: Red Hat OpenShift Service on AWS 1.0 enhancements

Bulletin has no description...

Malicious code in devplatform-api-v1-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58312f0f83e88c3dbd6f62bc334db255d0e3d5c6aed0d8d859dd0b17ce77557c On require of the package's main entry, setup.js fetches a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...

Malicious code in eacq-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fdb6bb562df94959130d84e06dc14aa40e9347c60da24dd32ce672024c2e0aa Requiring the package executes init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers...

EUVD-2026-54300

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

Amazon Kiro IDE 1.0.x < 1.0.228 Uncontrolled Search Path Element (Windows)

The version of Amazon Kiro IDE installed on the remote Windows host is 1.0.x prior to 1.0.228. It is, therefore, affected by a vulnerability. - An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code vi...

GHSA-HQVF-45JJ-MCCQ AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

CVE-2026-11976 MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

Malicious code in typst-resume-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 104d03639d9a9d48d03641fef83163391bb1540c8a01c56287bcaf8ca45ad01c index.js loads https, http, and childprocess at the top of the module and sends host/environment data to a hardcoded AWS Lambda URL at...

Wiz Brings Automated DISA STIG Assessment to Amazon Linux 2023 and Windows Server 2025

Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation...

Amazon and Apple impersonated in “$149.99 unauthorized charge” scam

If you’ve spent any time browsing lately, you may have run into a full-screen popup warning you that your Apple ID or Amazon account was just used for a mysterious $149.99 purchase. It looks urgent. It looks official. And if you look at two examples side by side, it becomes obvious that it’s...

AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

Security flaws in agent infrastructure from Amazon Web Services AWS, Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of the attack paths, the model never ran at all, so system prompts, content filters,...

CVE-2026-19111: Authorization Bypass Through User-Controlled Key

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...