CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103956

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103958

Loom for AWS versions before 1.7.0 are vulnerable to a Server-side request forgery (SSRF) in the tool server and remote agent connection handling. An authenticated remote user can exploit this by supplying a crafted connection address during the registration, updating, or testing of a tool server...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103957

A Server-side request forgery (SSRF) vulnerability exists in the OAuth2 discovery handling of Loom for AWS versions prior to 1.7.0 . An authenticated remote user can exploit this by supplying a crafted discovery document address when registering a tool server or remote agent configured for delega...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956

Loom for AWS versions before 1.6.1 are vulnerable to a critical flaw due to missing authentication for a critical function within the authentication dependency. In deployments where no identity provider is configured, remote actors can exploit this via any request to the application API to obtain...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

EUVD-2026-91770

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

Malicious code in dedh-devops-automation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e623272b4de65cc8af24a44d5405d9f6baa2c42896b50f9b7e0e5f294bfd2722 During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then...

CVE-2026-103505

A flaw was found in the AWS Elastic File System EFS Container Storage Interface CSI Driver. A remote authenticated user with permissions to create persistent storage volumes can supply crafted comma-separated values within volume configuration attributes. This improper input handling allows the...

CVE-2026-18953

CVE-2026-18953 — PoC Escritura arbitraria de archivos en awslabs.aws-transform-mcp-server servidor MCP de AWS Transform a través del parámetro savePath de la herramienta getresource. | ---|--- CVE| CVE-2026-18953 CWE| CWE-22 — Limitación inadecuada de un nombre de ruta a un directorio restringido...

canarytokens-docker

Dockerized Canarytokens by Thinkst Applied Research Overview Canarytokens help track activity and actions on your network. If you have any issues please check out our FAQ over here, or create an issue and we'll try to get back to you as soon as possible. Table of Contents Code of Conduct...

CloudPentestCheatsheets

CloudPentestCheatsheets Este repositorio contiene una colección de cheatsheets que he recopilado para herramientas relacionadas con el pentesting de organizaciones que utilizan proveedores de nube. El enfoque está en la enumeración ofensiva de nube y en comprender un entorno rápidamente. Estas...

bucket-brute

bucket-brute Aws S3 Tko Tool usage: bucket-brute.py -h -u URL -p PROXY -b BUCKET optional arguments: -h, --help show this help message and exit -u URL, --url URL No Such Bucket URL -p PROXY, --proxy PROXY Proxy for debugging -b BUCKET, --bucket BUCKET Bucket Name Example Creating mytest in region...

AWS-Key-Hunter

AWS-Key-Hunter AWS Key Hunter es una herramienta potente y automatizada que escanea repositorios de GitHub en busca de claves AWS expuestas. Supervisa continuamente los commits, detecta secretos de AWS tanto en formato base64 como en texto plano, y alerta a los usuarios sobre posibles riesgos de...

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

CVE-2026-21002 – Fuga de credenciales en arranque en frío de funciones serverless mediante reutilización de /tmp Código del programa simulación de AWS Lambda en Python lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm...