Important: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

Important: rclone

Issue Overview: The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback,...

Important: exiv2

Issue Overview: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server WebReady/Curl builds CVE-2026-68546 Affected Packages: exiv2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

Important: freeipmi

Issue Overview: FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses. CVE-2026-85504 Affected Packages: freeipmi Note: This advisory is applicable to...

CVE-2022-24611

CVE-2022-24611 Z-Wave S0-No-More攻撃の詳細。この攻撃の仕組みと調査結果を再現する方法についての完全な分析とレポートは、添付のPDFファイルを参照してください。 簡単な説明: S0およびS2デバイスに対するサービス妨害DoS攻撃Z-Wave ZW5xx製品ラインでテスト済み。具体的には、Z-Wave対応のAmazon Ring Gen. 1デバイスが対象です。攻撃者はS0...

GHSA-PG57-6JWG-Q645 vulnerabilities

Vulnerabilities for packages: nerdctl-fips, k3s, grype-db, neuvector, xeol-fips, tracee-fips, buildkitd-fips, crossplane-cli-fips, tigera-operator-fips, kaniko, docker-fips, envoy-gateway-fips, gitlab-rails-ce, neuvector-fips, atmos, helm-exporter-fips, kubescape-operator-fips, buildkitd, k9s-fip...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: nerdctl-fips, k3s, grype-db, neuvector, xeol-fips, tracee-fips, buildkitd-fips, crossplane-cli-fips, tigera-operator-fips, kaniko, docker-fips, envoy-gateway-fips, gitlab-rails-ce, neuvector-fips, atmos, helm-exporter-fips, kubescape-operator-fips, buildkitd, k9s-fip...

aws__aws-sdk-java_CVE-2022-31159_1-12-2600

AWS SDK for Java L'AWS SDK for Java permet aux développeurs Java de travailler facilement avec Amazon Web Servicesaws et de créer des solutions évolutives avec Amazon S3, Amazon DynamoDB, Amazon Glacier, et plus encore. Consultez l'AWS SDK for Java 2.xaws-sdk-for-java-2x pour savoir comment...

BIT-PARSE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

PT-2026-99008

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

openSUSE 16 Security Update : amazon-ssm-agent (openSUSE-SU-2026:21884-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21884-1 advisory. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library bsc127868...

EUVD-2026-38488

Language Servers for AWS Vulnerable to Arbitrary Code Execution...

CVE-2026-95985

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

EUVD-2026-86308

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

CVE-2026-95985: Inclusion of Functionality from Untrusted Control Sphere

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-131)

The version of kernel installed on the remote host is prior to 5.10.268-266.1094. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-131 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-115)

The version of kernel installed on the remote host is prior to 5.15.220-153.253. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2026-115 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-810...

PT-2026-98205

Name of the Vulnerable Software and Affected Versions Amazon Kiro IDE versions prior to 1.0.242 Description The file write tool allows remote unauthenticated actors to inject crafted instructions into the agent's context. This occurs when a user runs the agent within a crafted repository as an...

Security update for amazon-ssm-agent (important)

openSUSE security update: security update for amazon-ssm-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21884-1 Rating: important References: bsc1276981 bsc1276994 bsc1278681 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-71556...

CVE-2026-75935

A flaw was found in Amazon ion-java. This uncontrolled memory allocation vulnerability in the binary Ion stream cursor allows remote attackers to cause a denial of service DoS by sending a specially crafted Ion binary document. The crafted document contains a declared-length field that triggers...