SUSE CVE-2026-5190

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages. To remediate this issue, user...

Ubuntu: Security Advisory (USN-8143-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CLEANSTART-2026-JB52011 Security fixes for CVE-2025-47911, CVE-2025-58190, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-p77j-4mvh-x3m3 applied in versions: 1.11.1-r1, 1.11.1-r2

Multiple security vulnerabilities affect the velero-plugin-for-aws package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: mount-s3

Issue Overview: time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used...

GHSA-M866-6QV5-P2FG OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Summary Host execution env sanitization did not block GITTEMPLATEDIR or AWSCONFIGFILE, even though both can redirect trusted tooling to attacker-controlled content. Impact An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute untrust...

OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Summary Host execution env sanitization did not block GITTEMPLATEDIR or AWSCONFIGFILE, even though both can redirect trusted tooling to attacker-controlled content. Impact An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute untrust...

CVE-2026-5190

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages. To remediate this issue, user...

CVE-2026-5190 AWS C Event Stream Streaming Decoder Stack Buffer Overflow

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages. To remediate this issue, user...

aws-c-event-stream 安全漏洞

aws-c-event-stream is a C language implementation library for the event stream protocol, open-sourced by Amazon Web Services - Labs. Versions of aws-c-event-stream prior to 0.6.0 contain security vulnerabilities. These vulnerabilities stem from out-of-bounds writing in the stream decoder componen...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CEL-based HTTP functions. An attacker can make unauthorized network requests to internal or external resources and exfitrate sensitive information AWS IAM credentials, GCP tokens by crafting...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CEL-based HTTP functions. An attacker can make unauthorized network requests to internal or external resources and exfitrate sensitive information AWS IAM credentials, GCP tokens by crafting...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3, datadog-agent, crossplane-provider-aws-elasticache, crossplane-provider-aws-firehose, crossplane-provider-azure-sql, crossplane-provider-aws-eks, crossplane-provider-aws-iam, amazon-cloudwatch-agent, telegraf, crossplane-provider-aws-ec2,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-wafv2, crossplane-provider-aws-ecr, crossplane-provider-aws-cloudfront, amazon-cloudwatch-agent, aws-otel-collector, crossplane-provider-aws-memorydb, grafana-alloy-fips, crossplane-provider-aws-servicediscovery-fips,...

PT-2026-29110

Name of the Vulnerable Software and Affected Versions aws-mcp-server affected versions not specified Description aws-mcp-server is affected by a command injection issue that allows for remote code execution. This issue is related to the AWS CLI. It has been identified as a zero-day. Recommendatio...

Fedora 44 : pyOpenSSL (2026-5697f4e025)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5697f4e025 advisory. Update to version 26.0.0 - Added support for using aws-lc instead of OpenSSL. - Properly raise an error if a DTLS cookie callback returned a cookie...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via the CloudFront signing utilities when unsanitized input containing special characters is passed to the policy document generation process. An attacker can alter access restrictions by injecting specially...

AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction

This notification is related to the CloudFront signing utilities in the AWS SDK for .NET, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and...

GHSA-G3VH-WFH4-FP76 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp, linux-aws, linux-vmware, linux-azure...

CVE-2026-23227 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp, linux-aws, linux-vmware, linux-azure...

@activepieces/piece-google-gemini (=0.1.6), @activepieces/piece-google-vertexai (=0.1.2) +9 more potentially affected by CVE-2026-33750 via brace-expansion (>=2.0.0 <=2.0.2)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver =1.1.2 - nx-cargo =1.0.0-alpha.2 Source cves: CVE-2026-33750 Source advisory: OSV:GHSA-F886-M6HF-6M8V...