CVE-2026-6550

The vulnerability CVE-2026-6550 affects the AWS Encryption SDK for Python in its caching layer. A cryptographic downgrade in the key cache could allow an authenticated local actor to bypass key commitment policy enforcement, enabling ciphertext to be decrypted into multiple possible plaintexts. A...

CVE-2026-6550: Selection of Less-Secure Algorithm During Negotiation

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: linkerd2, consul-k8s, datadog-agent, juicefs-csi-driver, argo-rollouts, skaffold, k8sgpt-operator, kubevela, terraform-provider-kubernetes, trivy, k8sgpt, verticadb-operator, jitsucom-bulker, cilium-cli, kwok, postgres-operator, cilium, argocd-image-updater,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: linkerd2, consul-k8s, datadog-agent, juicefs-csi-driver, argo-rollouts, skaffold, k8sgpt-operator, kubevela, terraform-provider-kubernetes, trivy, k8sgpt, verticadb-operator, jitsucom-bulker, cilium-cli, kwok, postgres-operator, cilium, argocd-image-updater,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: rancher-support-bundle-kit, kubescape-server-fips, longhorn-cli, hubble-fips, kwok, neuvector-fips, kots, teleport-operator-fips, verticadb-operator-fips, gpu-operator-fips, argo-cd-fips, rke2-runtime, dynamic-localpv-provisioner, jitsucom-bulker, commercial-grafana,...

CVE-2026-6437

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users...

CVE-2026-6437 AWS EFS CSI Driver Mount Option Injection

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users...

CVE-2026-6437

CVE-2026-6437 concerns the AWS EFS CSI Driver (aws-efs-csi-driver) prior to v3.0.1. The flaw is improper neutralization of argument delimiters in the volume handling component, which allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via...

CVE-2026-6437: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users...

Amazon Linux 2 : amazon-efs-utils, --advisory ALAS2-2026-3245 (ALAS-2026-3245)

The version of amazon-efs-utils installed on the remote host is prior to 3.0.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3245 advisory. time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided t...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2026-1564)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1564 advisory. time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via...

Exploit for Server-Side Request Forgery in Vercel Next.Js

CVE-2024-34351 Demo Minimal Next.js 14.0.0 application for de...

EUVD-2026-21656

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handlin...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: karpenter, runc, fuse-overlayfs-snapshotter, k8s-device-plugin, aws-flb-firehose, dask-gateway, kine, external-secrets-operator, cilium-cli, gitaly, aws-flb-kinesis, cilium, go, falco-no-driver, cert-manager, kyverno, mattermost, coredns, istio, telegraf, snyk-cli,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: flux-source-controller, karpenter, pluto, aws-network-policy-agent, aws-load-balancer-controller, actions-runner-controller, flux-helm-controller, flux-image-automation-controller, mountpoint-s3-csi-driver, kubewatch, newrelic-infra-operator, envoy-ratelimit,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: karpenter, runc, gitness, terraform-docs, kubernetes-csi-driver-nfs, litestream, gitsign, mcp-grafana, sftpgo-plugin-eventstore, sriov-network-device-plugin, oauth2-proxy, datadog-agent, vexctl, k8sgpt-operator, cert-manager-cmctl, kine, apko, aws-flb-kinesis,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: mountpoint-s3-csi-driver, cluster-api-ipam-provider-in-cluster, kubewatch, mongo-tools, datadog-agent, pvc-autoresizer, dockerize, timescaledb-parallel-copy, pulumi-language-java, bento, speedtest-go, ingress-nginx-controller, kuberay-operator, descheduler,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: mountpoint-s3-csi-driver, cluster-api-ipam-provider-in-cluster, kubewatch, mongo-tools, datadog-agent, pvc-autoresizer, sbom-convert, dockerize, timescaledb-parallel-copy, pulumi-language-java, bento, calico, speedtest-go, ingress-nginx-controller, kuberay-operator,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: mountpoint-s3-csi-driver, cluster-api-ipam-provider-in-cluster, kubewatch, mongo-tools, datadog-agent, pvc-autoresizer, dockerize, timescaledb-parallel-copy, pulumi-language-java, bento, speedtest-go, ingress-nginx-controller, kuberay-operator, descheduler,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: karpenter, runc, gitness, terraform-docs, kubernetes-csi-driver-nfs, litestream, gitsign, mcp-grafana, sftpgo-plugin-eventstore, sriov-network-device-plugin, oauth2-proxy, datadog-agent, vexctl, k8sgpt-operator, cert-manager-cmctl, kine, apko, aws-flb-kinesis,...