altimeter (>=6.0.2rc1, <=6.4.25), apertium-apy (0.11.6) +103 more potentially affected by CVE-2026-115927 via tornado (5.1.1)

tornado PYPI version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - altimeter =6.0.2rc1, =0.45.0, =0.1.0, =0.3.0, =0.1.6, =0.7.0, =0.5.0, =0.1.1, =0.1.2 and more Source cves: CVE-2026-115927 Source advisory:...

altimeter (>=6.0.2rc1, <=6.4.25), apertium-apy (0.11.6) +103 more potentially affected by CVE-2026-116577 via tornado (5.1.1)

tornado PYPI version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - altimeter =6.0.2rc1, =0.45.0, =0.1.0, =0.3.0, =0.1.6, =0.7.0, =0.5.0, =0.1.1, =0.1.2 and more Source cves: CVE-2026-116577 Source advisory:...

aidoc (>=0.1.0, <=0.1.5), astrohack (>=0.0.1, <=0.1.6) +114 more potentially affected by CVE-2026-59890 via setuptools (65.6.3)

setuptools PYPI version 65.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - aidoc =0.1.0, =0.0.1, =0.96.0, =0.209.0, =1.1.31, =0.0.1a0, =0.1.1, =5.1.0, =0.1.4, =0.7.0, =0.1.0a1, =0.1.0, =0.2.4 - certifikadas8 0.1.1...

aws-service-catalog-factory (>=0.27.1, <=0.31.0), aws-service-catalog-puppet (>=0.45.0, <=0.50.3) +62 more potentially affected by CVE-2025-50181 via urllib3 (1.25.6)

urllib3 PYPI version 1.25.6 is affected by a known vulnerability. The following packages have a transitive dependency on urllib3 and may be impacted: - aws-service-catalog-factory =0.27.1, =0.45.0, =0.1.0, =1.0.1, =0.0.2, =3.0.1, =0.2.0, =0.0.1, =0.0.1, =0.0.5 and more Source cves: CVE-2025-50181...

CVE-2026-46456

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

net.snowflake:snowflake-jdbc-thin (4.0.0), org.apache.hadoop:hadoop-aws (3.4.2) +6 more potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (>=3.1.1, <=3.5.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version =3.1.1, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.2 Source cves: CVE-2025-14763 Source advisory: MEND:CVE-2025-14763...

EUVD-2019-18374

Malware in sbrugna...

ai-db (0.0.2), aws-service-catalog-puppet (0.242.1) +41 more potentially affected by CVE-2025-50181 via urllib3 (1.26.17)

urllib3 PYPI version 1.26.17 is affected by a known vulnerability. The following packages have a transitive dependency on urllib3 and may be impacted: - ai-db 0.0.2 - aws-service-catalog-puppet 0.242.1 - bondai =0.3.0b2, =1.6.37, =0.3.9, =0.3.10 - c7n-logexporter 0.4.31 - c7n-mailer 0.6.31 -...

aws-service-catalog-factory (>=0.27.1, <=0.31.0), aws-service-catalog-puppet (>=0.45.0, <=0.50.3) +62 more potentially affected by CVE-2025-50181 via urllib3 (1.25.6)

urllib3 PYPI version 1.25.6 is affected by a known vulnerability. The following packages have a transitive dependency on urllib3 and may be impacted: - aws-service-catalog-factory =0.27.1, =0.45.0, =0.1.0, =1.0.1, =0.0.2, =3.0.1, =0.2.0, =0.0.1, =0.0.1, =0.0.5 and more Source cves: CVE-2025-50181...

aws-service-catalog-factory (>=0.22.2, <=0.101.1), aws-service-catalog-puppet (>=0.1.0, <=0.41.0) potentially affected by CVE-2024-21542 via luigi (2.8.6)

luigi PYPI version 2.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-factory =0.22.2, =0.1.0, =0.41.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

aws-service-catalog-factory (>=0.4.0, <=0.22.1), aws-service-catalog-puppet (>=0.25.0, <=0.31.0) potentially affected by CVE-2024-21542 via luigi (2.8.7)

luigi PYPI version 2.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-factory =0.4.0, =0.25.0, =0.31.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

aws-service-catalog-puppet (>=0.42.0, <=0.95.0) potentially affected by CVE-2024-21542 via luigi (2.8.9)

luigi PYPI version 2.8.9 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-puppet =0.42.0, =0.95.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

aws-service-catalog-factory (>=0.4.0, <=0.22.1), aws-service-catalog-puppet (>=0.25.0, <=0.31.0) potentially affected by CVE-2024-21542 via luigi (2.8.7)

luigi PYPI version 2.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-factory =0.4.0, =0.25.0, =0.31.0 Source cves: CVE-2024-21542 Source advisory: OSV:PYSEC-2024-159...

aws-service-catalog-factory (>=0.22.2, <=0.101.1), aws-service-catalog-puppet (>=0.1.0, <=0.41.0) potentially affected by CVE-2024-21542 via luigi (2.8.6)

luigi PYPI version 2.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-factory =0.22.2, =0.1.0, =0.41.0 Source cves: CVE-2024-21542 Source advisory: OSV:PYSEC-2024-159...

aws-service-catalog-puppet (>=0.42.0, <=0.95.0) potentially affected by CVE-2024-21542 via luigi (2.8.9)

luigi PYPI version 2.8.9 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-puppet =0.42.0, =0.95.0 Source cves: CVE-2024-21542 Source advisory: OSV:PYSEC-2024-159...

Missing permission checks in AWS Credentials Plugin

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

GHSA-M9GV-4523-JFFM Missing permission checks in AWS Credentials Plugin

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27198

A cross-site request forgery CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27199

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27199

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...