CVE-2026-12957

Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This...

CVE-2026-12958 Arbitrary file write in Language Servers for AWS

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. To remediate...

CVE-2026-12958

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. To remediate...

CVE-2026-12957

Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: ratify-fips, step, cert-manager-cmctl, cert-manager-csi-driver-fips, gitlab-kas-fips, containerd, pinniped-fips, crossplane-provider-azure-authorization, neuvector-scanner, crossplane-provider-azure-storagesync, knative-net-istio, dgraph, packer-fips,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: ratify-fips, step, cert-manager-cmctl, cert-manager-csi-driver-fips, gitlab-kas-fips, containerd, pinniped-fips, crossplane-provider-azure-authorization, neuvector-scanner, crossplane-provider-azure-storagesync, knative-net-istio, dgraph, packer-fips,...

CVE-2026-54288

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge the body is...

CVE-2026-54288

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge the body is...

CVE-2026-54289

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so...

OPENSUSE-SU-2026:11077-1 ghc-aws-0.25.2-1.1 on GA media

These are all security issues fixed in the ghc-aws-0.25.2-1.1 package on the GA media of openSUSE Tumbleweed...

MAL-2026-6243 Malicious code in atlasora-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c54cd0923afe13aadf778a5c213363c521e7a50c4b9e235bf6c7cf58a973d On npm install, the package's postinstall hook node install.js, declared in package.json harvests secrets from the installer's machine and POSTs them...

Security Bulletin: Aspera Products and the Meltdown and Spectre vulnerabilities (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754)

Question Security Bulletin: Aspera Products and the Meltdown and Spectre vulnerabilities CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 "Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Product":"code":"SS8NDZ","label":"IBM...

EUVD-2025-210275

Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials...

Malicious code in scan-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a7779ff21d9783e1026e13a7abf65e448c5f3d3d111f3cae539f3690e53a2b4 The CLI binary at bin/scan-only.js, when invoked e.g., via npx scan-only --diagnose, harvests installer-side secrets and ships them to a hardcoded...

PT-2026-50549

Name of the Vulnerable Software and Affected Versions AWS Bedrock AgentCore Python SDK versions 1.1.3 through 1.6.0 Description Improper neutralization of argument delimiters in the install packages method of the Code Interpreter client allows a remote authenticated user to execute arbitrary...

GHSA-WFQV-66VQ-46RM vulnerabilities

Vulnerabilities for packages: ratify-fips, cloudbeat, crossplane, slsa-verifier, kyverno-notation-aws-fips, teleport, kyverno-policy-reporter-plugins-kyverno, kyverno-policy-reporter-plugins-kyverno-fips, skaffold, kyverno-notation-aws, ko-fips, ko, tkn, zot, aactl, commercial-kyverno,...

CVE-2026-24122 vulnerabilities

Vulnerabilities for packages: ratify-fips, cloudbeat, crossplane, slsa-verifier, kyverno-notation-aws-fips, teleport, kyverno-policy-reporter-plugins-kyverno, kyverno-policy-reporter-plugins-kyverno-fips, skaffold, kyverno-notation-aws, ko-fips, ko, tkn, zot, aactl, commercial-kyverno,...

CVE-2026-24122 vulnerabilities

Vulnerabilities for packages: skaffold, kyverno, kyverno-notation-aws, teleport, vexctl, ko, tekton-chains, zot, tkn, slsa-verifier, trivy-operator, trivy, crossplane, ratify, aactl...

aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 2.246.0 on Windows might allow a threat actor who...

MAL-2026-5789 Malicious code in claude-cup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c369ccf7b5e0ef8721b5ecdc94bd843ce260923394f6c513350a58928abdbdd3 On first invocation of npx claude-cup and on every subsequent Claude Code tool call once hooks are installed, research/config-audit.js enumerates eve...