Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

SummaryAn issue has been identified in the Bedrock AgentCore Starter Toolkit versions prior to v0.1.13 that may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. ImpactA remote actor could inject code during the build process, leadin...

Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.You shoul...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-pqc AWS Secrets Manager Key-Metadata Unsafe Deserializat...

EUVD-2026-43249

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function buildtargeturl of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extractedpathandquery can lead to server-side request forgery...

PT-2026-59020

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file api docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

PT-2026-59026

Summary Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. An issue exists where, under certain circumstances, a remote authenticated user with S3 write access to a...

PT-2026-59043

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...

CVE-2026-61448: Unrestricted Upload of File with Dangerous Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...

PT-2026-57441

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.1 Parse Server versions 8.x through 8.6.83 Description A stored cross-site scripting XSS issue exists when the software fails to recognize an uploaded file's extension via the mime package,...

CVE-2026-15296 affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkpproduct' shortcode in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. Th...

Amazon Linux 2 : virtuoso-opensource, --advisory ALAS2-2026-3799 (ALAS-2026-3799)

The version of virtuoso-opensource installed on the remote host is prior to 7.2.14-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3799 advisory. An issue in the chasharray component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Deni...

CVE-2026-15296: Improper Neutralization of Input During Web Page Generation

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkpproduct' shortcode in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. Th...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2026-126 (ALASKERNEL-5.4-2026-126)

The version of kernel installed on the remote host is prior to 5.4.302-226.484. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-126 advisory. In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3801 (ALAS-2026-3801)

The version of kernel installed on the remote host is prior to 4.14.355-284.740. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3801 advisory. In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-109 (ALASKERNEL-5.15-2026-109)

The version of kernel installed on the remote host is prior to 5.15.210-148.247. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2026-109 advisory. In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current ...

CVE-2026-53961

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish...