PYSEC-2026-384 Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Vulnerability Summary Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via...

PYSEC-2026-339 FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...

CVE-2026-13763: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This iss...

CVE-2026-13762: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:2643-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2643-1 advisory. This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385:...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: ko, kyverno-fips, commercial-kyverno, spire-server, docker-fips, slsa-verifier, zarf, zarf-fips, kyverno-notation-aws, policy-controller-fips, tflint, tkn-fips, kubescape-server, ratify-fips, gitsign, ko-fips, kubescape, chainctl-fips, goreleaser, kyverno, tflint-fip...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: ko, kyverno-fips, commercial-kyverno, spire-server, docker-fips, slsa-verifier, zarf, zarf-fips, kyverno-notation-aws, policy-controller-fips, tflint, tkn-fips, kubescape-server, ratify-fips, gitsign, ko-fips, kubescape, chainctl-fips, goreleaser, kyverno, tflint-fip...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: vault, spire-server, knative-eventing-fips, traefik, coder, zarf, etcd-fips, rancher-agent, zarf-fips, gatekeeper, kubescape-server, k9s-fips, kube-state-metrics, prometheus-fips, falco-no-driver, flux-source-controller, harbor, aactl, calico-fips, cilium, prometheus...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: vault, syft, coder, packer, crossplane-provider-aws-kafka-fips, crossplane-provider-azure-resources, crossplane-provider-aws-ec2, gatekeeper, scorecard, crossplane-provider-aws-servicediscovery, crossplane-provider-aws-rolesanywhere-fips, prometheus-fips, consul,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: prometheus-operator, kaf, cilium-cli, kine, telegraf, flux-image-automation-controller, argocd-image-updater, aactl, osv-scanner, trivy, kubernetes-dashboard, containerd, istio, cilium, falco-no-driver, trivy-operator, k3s, rancher-agent, loki, kubernetes,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: prometheus-operator, kaf, osv-scanner, kargo, nfpm, policy-controller, fulcio, steampipe, crossplane-provider-azure-managedidentity, hcloud, slsa-verifier, trivy-operator, wal-g, pulumi-language-java, tekton-chains, gitlab-runner, pulumi-language-dotnet, scorecard,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: prometheus-operator, kaf, osv-scanner, nfpm, trivy-operator, pulumi-language-java, pulumi-language-dotnet, scorecard, nerdctl, spire-server, k9s, kubescape, guac, docker-cli-buildx, grype, flux-source-controller, cilium-cli, aactl, dagger, step-issuer, falco-no-drive...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: prometheus-operator, kaf, cilium-cli, kine, telegraf, aactl, buildah, kubernetes-dashboard, containerd, istio, cilium, falco-no-driver, k3s, rancher-agent, loki, kubernetes, external-dns, flux, helm, prometheus, kots, external-secrets-operator, nerdctl, cert-manager,...

Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues CVE-2022-1996: CORS bypass bsc1200528. CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. CVE-2025-47910: net/http:...

SUSE-SU-2026:2643-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. - CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. - CVE-2025-47910: net/http:...

CVE-2026-50137: Missing Authorization

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...

GO-2026-5601 AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

MAL-2026-6486 Malicious code in unsafe-malicious-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3579cb796e48f446b07e2dbbce2e301d1a3e87d8a9a35ed1dbe825fc53f29da9 On npm install, the package's postinstall lifecycle script scripts/postinstall.js reads the installer's AWS credentials file at /.aws/credentials and...

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Vulnerability Summary Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via...