CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version...

CVE-2026-104020

The Amazon Ion Python library (versions prior to 0.15.0 ) is vulnerable to a denial of service due to uncontrolled recursion in the Ion reader . A remote, unauthenticated actor can crash the application by providing a crafted, deeply nested Ion value. To remediate this issue, users should upgrade...

EUVD-2026-91059

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version...

DefinitelyNotPhishing

⚠️ Disclaimer This repository is intended solely for educational and testing purposes. All tools, configurations, and resources included here such as phishing templates, red team utilities, or offensive security scripts are provided strictly for use in authorized environments , such as labs, demos...

Dirty-Frag-Kubernetes-PoC

Dirty Frag CVE-2026-43284 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a default, unprivileged Kubernetes Pod can achieve node-level code execution on Amazon EKS by exploiting the Dirty Frag Linux kernel page-cache corruption vulnerability through shared container image...

copy-fail-CVE-2026-31431

Copy Fail - CVE-2026-31431 Copy Fail CVE-2026-31431 PoC and payload examples. Technical Writeup: https://xint.io/blog/copy-fail-linux-distributions Affected Linux Distributions Distro| Kernel Version ---|--- Ubuntu 24.04 LTS| 6.17.0-1007-aws Amazon Linux 2023| 6.18.8-9.213.amzn2023 RHEL 10.1|...

l4j-fp1

log4shell false positive This is a simple web project with a sanitised log4shell vulnerability. For an unsanitised version, see https://github.com/scabench/l4j-tp1/. The project defines a simple scabench.HelloWorldService get service returning a plain text string hello world. The service does not...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-131)

The version of kernel installed on the remote host is prior to 5.4.302-229.498. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2026-131 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own...

PT-2026-104008

Name of the Vulnerable Software and Affected Versions Amazon Ion Python versions prior to 0.15.0 Description Uncontrolled recursion in the Ion reader allows a remote unauthenticated actor to cause a denial of service by crashing the application. This is achieved by providing a crafted, deeply...

Critical: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-3149)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3149 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-425...

SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4388-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4388-1 advisory. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3146)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3146 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. CVE-2026-80521 Tenable has extracted the preceding description block directly from the tested...

Critical: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3148)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3148 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. CVE-2026-80521 Tenable has extracted the preceding description block directly from the tested...

slot2

slot2 slot2: a two-stage UEFI GRUB2 bootkit that persists a pre-OS networked implant on Amazon Linux 2023 on AWS EC2 UEFI x8664. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/slot2 Summary slot2 is a bootkit for Amazon Linux 2023 on EC2. The AWS EC2 UEFI firmware load...

CVE-2026-100308

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-100308

The Amazon GluonTS library is vulnerable to arbitrary command execution in versions prior to 0.17.0 . The root cause is the deserialization of untrusted data within the model loading component, which may allow context-dependent attackers to execute OS commands with the privileges of the loading p...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...