Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CEL-based HTTP functions. An attacker can make unauthorized network requests to internal or external resources and exfitrate sensitive information AWS IAM credentials, GCP tokens by crafting...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2, crossplane-provider-aws-rds, crossplane-provider-aws-elasticache, crossplane-provider-aws-kinesis, crossplane-provider-aws-s3, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-kms, crossplane-provider-family-aws,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-aws, crossplane-provider-aws-route53-fips, tempo, crossplane-provider-aws-route53, crossplane-provider-aws-elasticache-fips, crossplane-provider-aws-wafv2, crossplane-provider-aws-ecr, crossplane-provider-aws-backup-fips,...

CVE-2026-1612: Use of Hard-coded Credentials

AL-KO Robolinho Update Software has hard-coded AWS Access and Secret keys that allow anyone to access AL-KO's AWS bucket. Using the keys directly might give the attacker greater access than the app itself. Key grants AT LEAST read access to some of the objects in bucket. The vendor was notified...

PT-2026-29110

Name of the Vulnerable Software and Affected Versions aws-mcp-server affected versions not specified Description aws-mcp-server is affected by a command injection issue that allows for remote code execution. This issue is related to the AWS CLI. It has been identified as a zero-day. Recommendatio...

Fedora 44 : pyOpenSSL (2026-5697f4e025)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5697f4e025 advisory. Update to version 26.0.0 - Added support for using aws-lc instead of OpenSSL. - Properly raise an error if a DTLS cookie callback returned a cookie...

ais-dom (>=0.109.0b0, <=0.109.7), aws-gate (0.8.8) +10 more potentially affected by CVE-2026-34073 via cryptography (2.9.0)

cryptography PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.109.0b0, =0.3.0a0, =0.109.0b0, =2.0.0rc1, =2.3.7, =1.37.1, =1.37.8 - tornado-widgets 0.0.17 Source cves: CVE-2026-34073 Sourc...

acmetk (0.0.2), aioasuswrt (1.3.3) +136 more potentially affected by CVE-2026-34073 via cryptography (3.3.2)

cryptography PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - acmetk 0.0.2 - aioasuswrt 1.3.3 - ais-dom =2021.3.0b4, =1.6.0, =10.0.0, =1.10.0, =1.8.0, =2.20.0, =2.20.0, =1.0.1, =0.3.27, =0.5.6, =0.8...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via the CloudFront signing utilities when unsanitized input containing special characters is passed to the policy document generation process. An attacker can alter access restrictions by injecting specially...

PT-2026-30769

Summary This notification is related to the CloudFront signing utilities in the AWS SDK for PHP, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and...

PT-2026-30778

Summary This notification is related to the CloudFront signing utilities in the AWS SDK for .NET, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and...

AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction

This notification is related to the CloudFront signing utilities in the AWS SDK for .NET, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and...

PT-2026-30772

Summary This notification is related to the CloudFront signing utilities in the AWS SDK for Java v2, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes an...

GHSA-G3VH-WFH4-FP76 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-aws, linux-qemu...

CVE-2026-23227 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure, linux-vmware, linux-aws, linux-qemu...

Ubuntu: Security Advisory (USN-8121-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8112-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8112-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AWS VDP: V2Plugin.Decrypt panics on empty ciphertext (Remote DoS)

A vulnerability was discovered in the "aws-encryption-provider" component where the "V2Plugin.Decrypt" function accessed the ciphertext slice without checking if it was empty, leading to a panic and crashing the entire gRPC server process...

AWS VDP: V1Plugin.Decrypt panics on empty ciphertext (Remote DoS)

A vulnerability was discovered in the aws-encryption-provider component of the pkg/plugin/plugin.go file at revision 4341c70. The vulnerability caused the V1Plugin.Decrypt function to panic when passed an empty ciphertext, crashing the entire gRPC server process. This was due to the function...