5232 matches found
aws-nitro-enclaves-binaryblobs-upstream-1.4.5~git0.18a5f6f-1.1 on GA media (moderate)
aws-nitro-enclaves-binaryblobs-upstream-1.4.5git0.18a5f6f-1.1 on GA media Announcement ID: openSUSE-SU-2026:11275-1 Rating: moderate Cross-References: CVE-2026-41678 CVE-2026-41898 CVE-2026-42327 CVE-2026-45784 CVSS scores: CVE-2026-41678 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H...
CVE-2026-15895
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...
EUVD-2026-44768
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...
Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid
This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...
OPENSUSE-SU-2026:11275-1 aws-nitro-enclaves-binaryblobs-upstream-1.4.5~git0.18a5f6f-1.1 on GA media
These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.4.5git0.18a5f6f-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-15738 Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller
Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource. To mitigate this...
CVE-2026-15738
The CVE-2026-15738 issue affects the AWS Load Balancer Controller prior to version 3.4.2, where incorrect behavior order in Gateway API listener-rule generation can let an authenticated remote user intercept, spoof, or deny another namespace’s gRPC traffic on a shared Gateway via a crafted HTTPRo...
PYSEC-2026-3080 OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently...
PYSEC-2026-2387 AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache
Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...
PYSEC-2026-2363 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...
CVE-2026-15508 Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery
A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function buildtargeturl of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extractedpathandquery can lead to server-side request forgery...
CVE-2026-15508
Helicone ai-gateway (up to 0.2.0-beta.30) is affected. The flaw is in the AWS Metadata Service component, specifically the build_target_url function in ai-gateway/src/dispatcher/service.rs, where manipulating extracted_path_and_query can trigger server-side request forgery. Exploitation is possib...
PT-2026-57575
A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build target url of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extracted path and query can lead to server-side request...
GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities
Vulnerabilities for packages: teleport, image-factory, tflint-fips, falcoctl-fips, kubescape-server-fips, kubescape-server, tekton-chains, tflint, aactl, neuvector-sigstore-interface-fips, zarf, gitsign, cloudbeat, docker-fips, tkn-fips, zarf-fips, policy-controller, spire-server-fips, tkn,...
GHSA-FF52-PH69-CF7X vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-swf-fips, vale, ocm-cli, terraform-provider-azuread-fips, rancher-system-upgrade-controller-fips, azure-workload-identity-webhook, kafkaexporter-fips, dcgm-exporter-fips, seaweedfs-fips, ceph-csi-operator-fips, yunikorn-web-fips,...
GHSA-FF52-PH69-CF7X vulnerabilities
Vulnerabilities for packages: nfpm, kyverno-policy-reporter-ui, local-path-provisioner, istio, gatekeeper, dapr, harbor-registry, gatus, tempo, ferretdb, k8s-device-plugin, crossplane-provider-sql, snyk-cli, gcsfuse, nri-f5, nuclei, kyverno, slsa-verifier, crossplane-provider-aws-route53, croc,...
CVE-2026-31589 vulnerabilities
Vulnerabilities for packages: linux-aws...
CVE-2026-42505 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-swf-fips, vale, ocm-cli, terraform-provider-azuread-fips, rancher-system-upgrade-controller-fips, azure-workload-identity-webhook, kafkaexporter-fips, dcgm-exporter-fips, seaweedfs-fips, ceph-csi-operator-fips, yunikorn-web-fips,...