0.workspace (>=0.1.0, <=0.1.1), 18a58t9c-upload (>=1.0.0, <=1.0.3) +17980 more potentially affected by unknown CVE via aws-sdk (>=2.0.4, <=2.1693.0)

aws-sdk NPM version =2.0.4, =0.1.0, =1.0.0, =0.21.0, =1.0.0, =1.0.0, =0.1.0, =3.6.0, =0.0.2, =0.3.0-2, =0.1.0, =0.5.0 and more Source cves: unknown CVE Source advisory: GHSA-J965-2QGJ-VJMQ...

0.workspace (>=0.1.0, <=0.1.1), 18a58t9c-upload (>=1.0.0, <=1.0.3) +17980 more potentially affected by unknown CVE via aws-sdk (>=2.0.4, <=2.1693.0)

aws-sdk NPM version =2.0.4, =0.1.0, =1.0.0, =0.21.0, =1.0.0, =1.0.0, =0.1.0, =3.6.0, =0.0.2, =0.3.0-2, =0.1.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J965-2QGJ-VJMQ...

PT-2026-6459

CVSSv3.1 Rating: 3.7 LOW Summary This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. A defense-in-depth enhancement h...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0732

Updates of 'aws-sdk-cpp', 'glib', 'curl', 'capstone' packages of Photon OS have been released...

Malicious Package

Overview aws-target-mediator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-129 Malicious code in aws-target-mediator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ebc5003f75ac973cedd53d212f4d9b3dc016b36e43b24ca0a10e77e485b9141 The package aws-target-mediator was found to contain malicious code. Source: ghsa-malware...

CVE-2022-27198

A cross-site request forgery CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2022-27199

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token...

CVE-2025-1969

Improper request input validation in Temporary Elevated Access Management TEAM for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process...

CVE-2024-12401 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-istio-csr, cert-manager-cmctl, step-issuer, aws-privateca-issuer, cert-exporter...

GHSA-GHW8-3XQW-HHCJ vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-istio-csr, cert-manager-cmctl, step-issuer, aws-privateca-issuer, cert-exporter...

GHSA-GHW8-3XQW-HHCJ vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns-fips, step-issuer, aws-privateca-issuer, cert-manager-cmctl, cert-exporter, cert-exporter-fips, cert-manager-webhook-pdns, step-issuer-fips, aws-privateca-issuer-fips, cert-manager-istio-csr, cert-manager-cmctl-fips...

GHSA-F9JG-8P32-2F55 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips...

CVE-2024-12401 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns-fips, step-issuer, aws-privateca-issuer, cert-manager-cmctl, cert-exporter, cert-exporter-fips, cert-manager-webhook-pdns, step-issuer-fips, aws-privateca-issuer-fips, cert-manager-istio-csr, cert-manager-cmctl-fips...

Server-side Request Forgery (SSRF)

Overview io.spinnaker.clouddriver:clouddriver-aws is a Spinnaker Clouddriver Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper restrictions on user-supplied URLs when fetching data. An attacker can access internal resources, extract sensitive...

Malicious code in chalk-aws (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-192895 Malicious code in chalk-aws (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

org.apache.hadoop:hadoop-aws (3.4.2) potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (3.1.1)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on software.amazon.encryption.s3:amazon-s3-encryption-client-java and may be impacted: - org.apache.hadoop:hadoop-aws 3.4.2...

org.apache.nifi:nifi-aws-abstract-processors (>=2.7.0, <=2.7.2), org.apache.nifi:nifi-aws-kinesis-nar (>=2.7.0, <=2.7.2) +4 more potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (3.5.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on software.amazon.encryption.s3:amazon-s3-encryption-client-java and may be impacted: -...

CVE-2025-14762

A flaw was found in the AWS SDK for Ruby, an open-source client-side encryption library. A user with write access to an S3 Simple Storage Service bucket can exploit a missing cryptographic key commitment. This allows the introduction of a new Encrypted Data Key EDK that decrypts to different...