Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-062 (ALASFIREFOX-2026-062)

The version of firefox installed on the remote host is prior to 140.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-062 advisory. Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox E...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-124 (ALASKERNEL-5.10-2026-124)

"The version of kernel installed on the remote host is prior to 5.10.259-258.1043. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-124 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free i...

EUVD-2026-42115

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object key...

OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization...

AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Description of Vulnerability:An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service RDS...

PYSEC-2026-1490 OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization...

composio Server-Side Request Forgery (SSRF) vulnerability

A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITECONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system...

FastChat Server-Side Request Forgery vulnerability

A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...

PYSEC-2026-1396 FastChat Server-Side Request Forgery vulnerability

A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...

Malicious code in amazon-core (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7110 Malicious code in amazon-core (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in amazon-data (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7111 Malicious code in amazon-data (npm)

--- -= Per source details. Do not edit below this line.=-...

Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

PYSEC-2026-768 Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

Medium: opensc

Issue Overview: A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The...

Important: expat

Issue Overview: libexpat before 2.8.2 has an integer overflow in storeAtts. CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse. CVE-2026-56406 libexpat before 2.8.2 has an integer overflow in doProlog that is relat...

Important: expat

Issue Overview: In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. CVE-2026-56132 Affected Packages: expat Issue Correction: Run dnf update expat...

Important: util-linux

Issue Overview: Integer Overflow or Wraparound in libblkid/src/partitions/dos.c CVE-2026-53615 Affected Packages: util-linux Issue Correction: Run dnf update util-linux --releasever 2023.12.20260706 or dnf update --advisory ALAS2023-2026-1916 --releasever 2023.12.20260706 to update your system...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path CVE-2026-53366...