Amazon Linux 2023 : mod_security_crs (ALAS2023-2026-1562)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1562 advisory. Whitespace padding in filenames bypasses file upload extension checks NOTE: https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w CVE-2026-33691 Tenable has extracted the...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1584)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1584 advisory. When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore ma...

Amazon Linux 2023 : runc (ALAS2023-2026-1541)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1541 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or...

Medium: runc

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-1535)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1535 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir o...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-1573)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1573 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir o...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2026-1574)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1574 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-1575)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1575 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or...

Amazon Linux 2023 : yq (ALAS2023-2026-1582)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1582 advisory. The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially...

Medium: amazon-ecr-credential-helper

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

Command Injection

Overview aws-mcp is an AWS Model Context Protocol Server Affected versions of this package are vulnerable to Command Injection via improper validation of user-supplied input in the allowed commands process. An attacker can execute arbitrary system commands by supplying crafted input that is used ...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: jaeger-fips, cilium, docker-compose-fips, external-secrets-operator, jaeger, tofu-controller, gitlab-workhorse-ce, trivy-operator-fips, grafana, consul-fips, flux-helm-controller-fips, opentofu-fips, aws-flb-firehose-fips, cilium-envoy, keda-fips, ko, apko-fips,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventsearch, jaeger-fips, cilium, db-operator-fips, docker-compose-fips, external-secrets-operator, flux-image-automation-controller, blob-csi-fips, longhorn-backing-image-manager, jaeger, tofu-controller, gitlab-workhorse-ce, trivy-operator-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: jaeger-fips, cilium, docker-compose-fips, external-secrets-operator, jaeger, tofu-controller, gitlab-workhorse-ce, trivy-operator-fips, grafana, consul-fips, flux-helm-controller-fips, opentofu-fips, aws-flb-firehose-fips, cilium-envoy, keda-fips, ko, apko-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: kubevirt-cdi-apiserver-fips, pgpool2exporter, infinispan-operator, gitlab-workhorse-ce, plugin-barman-cloud, gpu-operator-fips, grafana, mongodb-kubernetes-operator, consul-fips, juicefs-csi-driver, opentofu-fips, local-path-provisioner-fips, keda-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: sealed-secrets-fips, sftpgo-plugin-eventsearch, kubevirt-cdi-apiserver-fips, cyberark-secrets-provider-for-k8s-fips, jaeger-fips, infinispan-operator, cilium, pgpool2exporter, db-operator-fips, docker-compose-fips, external-secrets-operator,...

CVE-2026-5059 aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handlin...

CVE-2026-5059

CVE-2026-5059 – aws-mcp-server is a command-injection remote code execution vulnerability. The flaw occurs in how the server handles the allowed commands list, due to insufficient validation of a user-supplied string before it is used to perform a system call. This allows an unauthenticated attac...

aws-mcp-server 操作系统命令注入漏洞

aws-mcp-server is a lightweight service developed by Alexei Ledenev. It enables AI assistants to execute AWS CLI commands through the Model Context Protocol MCP in a secure, containerized environment. aws-mcp-server has an operating system command injection vulnerability, which stems from...

aws-mcp-server 操作系统命令注入漏洞

aws-mcp-server is a lightweight service developed by Alexei Ledenev. It enables AI assistants to execute AWS CLI commands through the Model Context Protocol MCP in a secure, containerized environment. aws-mcp-server has an operating system command injection vulnerability, which stems from...