PYSEC-2026-1267 composio Server-Side Request Forgery (SSRF) vulnerability

A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITECONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system...

Linux Distros Unpatched Vulnerability : CVE-2026-13769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file...

CVE-2026-56140

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter...

CVE-2026-46590

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

CVE-2026-46456

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

CVE-2026-43867

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata reads that metadata back from the...

CVE-2026-43867

The CVE concerns Apache Camel’s PQC component where AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() Base64-decodes and deserializes persisted KeyMetadata via a raw java.io.ObjectInputStream.readObject() without an ObjectInputFilter or class allow-list. A user who can write to the confi...

CVE-2026-46456

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

CVE-2026-46456 Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

CVE-2026-54430

A flaw was found in liboauth2 in the oauth2josejwksawsalbresolve function. The AWS ALB JWT verifier reads the signer and kid fields from the unverified JWT header. When signer matches the configured ARN, kid is appended to the ALB base URL without path sanitization, and an HTTP GET request is...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, linkerd2-fips, gitlab-operator, zarf-fips, tigera-operator-fips, rancher, k8ssandra-client-fips, crossplane, gatekeeper, jfrog-cli, falcoctl-fips, trivy-fips, kots, cloudbeat, crossplane-fips, teleport, envoy-gateway-fips, helm-set-status,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: k8ssandra-client, linkerd2-fips, gitlab-operator, zarf-fips, tigera-operator-fips, rancher, k8ssandra-client-fips, crossplane, gatekeeper, jfrog-cli, falcoctl-fips, trivy-fips, kots, cloudbeat, crossplane-fips, teleport, envoy-gateway-fips, helm-set-status,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, linkerd2-fips, gitlab-operator, zarf-fips, tigera-operator-fips, rancher, k8ssandra-client-fips, crossplane, gatekeeper, jfrog-cli, falcoctl-fips, trivy-fips, kots, cloudbeat, crossplane-fips, teleport, envoy-gateway-fips, helm-set-status,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, linkerd2-fips, gitlab-operator, zarf-fips, tigera-operator-fips, rancher, k8ssandra-client-fips, crossplane, gatekeeper, jfrog-cli, falcoctl-fips, trivy-fips, kots, cloudbeat, crossplane-fips, teleport, envoy-gateway-fips, helm-set-status,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, k9s, consul-k8s, eksctl, tigera-operator, trivy-operator, cluster-api-helm-controller, k8ssandra-client, kubescape, gatekeeper, kots, falcoctl, rancher, helm-operator, teleport, oras, tw, argocd-image-updater, vcluster, kyverno, opentofu, argo-cd,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, k9s, consul-k8s, eksctl, tigera-operator, trivy-operator, cluster-api-helm-controller, k8ssandra-client, kubescape, gatekeeper, kots, falcoctl, rancher, helm-operator, teleport, oras, tw, argocd-image-updater, vcluster, kyverno, opentofu, argo-cd,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, k9s, consul-k8s, eksctl, tigera-operator, trivy-operator, cluster-api-helm-controller, k8ssandra-client, kubescape, gatekeeper, kots, falcoctl, rancher, helm-operator, teleport, oras, tw, argocd-image-updater, vcluster, kyverno, opentofu, argo-cd,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, k9s, consul-k8s, eksctl, tigera-operator, trivy-operator, cluster-api-helm-controller, k8ssandra-client, kubescape, gatekeeper, kots, falcoctl, rancher, helm-operator, teleport, oras, tw, argocd-image-updater, vcluster, kyverno, opentofu, argo-cd,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, k9s, consul-k8s, eksctl, tigera-operator, trivy-operator, cluster-api-helm-controller, k8ssandra-client, kubescape, gatekeeper, kots, falcoctl, rancher, helm-operator, teleport, oras, tw, argocd-image-updater, vcluster, kyverno, opentofu, argo-cd,...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, k9s, consul-k8s, eksctl, tigera-operator, trivy-operator, cluster-api-helm-controller, k8ssandra-client, kubescape, gatekeeper, kots, falcoctl, rancher, helm-operator, teleport, oras, tw, argocd-image-updater, vcluster, kyverno, opentofu, argo-cd,...