com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-104714 via org.apache.struts:struts2-core (>=6.0.0, <=6.11.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-104714 Source advisory: MEND:CVE-2...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-104712 via org.apache.struts:struts2-core (>=6.0.0, <=6.11.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-104712 Source advisory: MEND:CVE-2...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-104711 via org.apache.struts:struts2-core (>=6.0.0, <=6.11.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-104711 Source advisory: MEND:CVE-2...

com.amazonaws.serverless:aws-serverless-java-container-springboot4 (>=3.0.0, <=3.0.3), org.springframework.cloud:spring-cloud-function-adapter-azure-web (>=5.0.0, <=5.0.3) potentially affected by CVE-2026-59297 via org.springframework.cloud:spring-cloud-function-serverless-web (>=5.0.0, <=5.0.3)

org.springframework.cloud:spring-cloud-function-serverless-web MAVEN version =5.0.0, =3.0.0, =5.0.0, =5.0.3 Source cves: CVE-2026-59297 Source advisory: MEND:CVE-2026-59297...

com.amazonaws.serverless:aws-serverless-java-container-springboot4 (>=3.0.0, <=3.0.3), org.springframework.cloud:spring-cloud-function-adapter-azure-web (>=4.2.0, <=5.0.3) potentially affected by CVE-2026-59297 via org.springframework.cloud:spring-cloud-function-serverless-web (>=4.2.0, <=5.0.3)

org.springframework.cloud:spring-cloud-function-serverless-web MAVEN version =4.2.0, =3.0.0, =4.2.0, =5.0.3 Source cves: CVE-2026-59297 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267419...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-core (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-73634 Source advisory: SNYK:JAVA-OR...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +168 more potentially affected by CVE-2025-68493 via org.apache.struts:struts2-core (>=2.5, <=2.5.33)

org.apache.struts:struts2-core MAVEN version =2.5, =1.2, =1.0.0-release, =1.1.9, =0.0.1, =6.0.0-rc1, =2.5.0, =2.5.0, =4.0.1, =4.0.3 and more Source cves: CVE-2025-68493 Source advisory: OSV:GHSA-QCFC-HMRC-59X7...

@neptune.digital/sentry-netlify-v2 (1.2.1) potentially affected by CVE-2025-65944 via @sentry/aws-serverless (10.19.0)

@sentry/aws-serverless NPM version 10.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sentry/aws-serverless and may be impacted: - @neptune.digital/sentry-netlify-v2 1.2.1 Source cves: CVE-2025-65944 Source advisory: MEND:CVE-2025-65944...

@neptune.digital/sentry-netlify-v2 (1.2.1) potentially affected by CVE-2025-65944 via @sentry/aws-serverless (10.19.0)

@sentry/aws-serverless NPM version 10.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sentry/aws-serverless and may be impacted: - @neptune.digital/sentry-netlify-v2 1.2.1 Source cves: CVE-2025-65944 Source advisory: OSV:GHSA-6465-JGVQ-JHGP...

@neptune.digital/sentry-netlify-v2 (1.2.1) potentially affected by CVE-2025-65944 via @sentry/aws-serverless (10.19.0)

@sentry/aws-serverless NPM version 10.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sentry/aws-serverless and may be impacted: - @neptune.digital/sentry-netlify-v2 1.2.1 Source cves: CVE-2025-65944 Source advisory: GHSA-6465-JGVQ-JHGP...

CVE-2025-3047

When running the AWS Serverless Application Model Command Line Interface SAM CLI build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A use...

AWS SAM CLI Path Traversal allows file copy to build container

Summary The AWS Serverless Application Model Command Line Interface AWS SAM CLI is an open-source CLI tool that helps Lambda developers to build and develop Lambda applications locally on their computers using Docker. When running the AWS SAM CLI build process with Docker and symlinks are include...

CVE-2025-3048

After completing a build with AWS Serverless Application Model Command Line Interface SAM CLI which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outsid...

CVE-2025-3047

When running the AWS Serverless Application Model Command Line Interface SAM CLI build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A use...

CVE-2025-3048

CVE-2025-3048 concerns AWS SAM CLI. When building with Docker (--use-container) and symlinks are included, the content of those symlinks can be copied into the SAM CLI cache as regular files/directories, potentially exposing privileged host files to users within the local workspace. This affects ...

CVE-2025-3048 Path Traversal in AWS SAM CLI allows file copy to local cache

After completing a build with AWS Serverless Application Model Command Line Interface SAM CLI which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outsid...

CVE-2025-3047

CVE-2025-3047 affects the AWS SAM CLI when building with Docker in the local workspace. The issue arises from symlinks in build files, enabling a user to access privileged host files through the container’s elevated permissions. Impact is limited to local workspaces using container builds and doe...

CVE-2025-3047: UNIX Symbolic Link (Symlink) Following

When running the AWS Serverless Application Model Command Line Interface SAM CLI build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A use...

CVE-2025-3048: UNIX Symbolic Link (Symlink) Following

After completing a build with AWS Serverless Application Model Command Line Interface SAM CLI which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outsid...

@mrmtech/splice-lambda (>=0.1.0, <=6.4.0) potentially affected by unknown CVE via @sentry/aws-serverless (>=8.26.0, <=8.30.0)

@sentry/aws-serverless NPM version =8.26.0, =0.1.0, =6.4.0 Source cves: unknown CVE Source advisory: GHSA-R5W7-F542-Q2J4...