Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVPaes128ccm, EVPaes192ccm, and EVPaes256ccm. Customers of AWS servic...

RUSTSEC-2026-0046 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Improper certificate validation in PKCS7verify in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC...

jsonwebtoken-aws-lc (=9.3.0), jwts (>=0.5.0 <=0.5.1) +2 more potentially affected by CVE-2026-3337 via aws-lc-sys (>=0.14.1 <=0.21.0)

aws-lc-sys CARGO version =0.14.1, =0.5.0, =0.102.2, =0.20.0, =0.31.0 Source cves: CVE-2026-3337 Source advisory: OSV:RUSTSEC-2026-0045...

RUSTSEC-2026-0045 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVPaes128ccm, EVPaes192ccm, and EVPaes256ccm. Customers of AWS servic...

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Improper certificate validation in PKCS7verify in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. aws-lc-sys contains code from AWS-LC...

Ubuntu: Security Advisory (USN-8059-6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AWS libcrypto 安全漏洞

AWS libcrypto is a general-purpose encryption library open sourced by Amazon Web Services. Versions of AWS libcrypto prior to 1.69.0 contained security vulnerabilities. These vulnerabilities stemmed from improper certificate verification in the PKCS7verify function. It was possible to bypass the...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-kms, dagdotdev, minio-fips, kubescape-operator-fips, secrets-store-csi-driver-provider-gcp-fips, cloudbeat-fips, cri-tools, cloud-provider-aws-fips, kube-metrics-adapter-fips, prometheus-alertmanager, jaeger-operator, kubernetes-csi-external-snapshotter...

AWS CLI: cli_history database does not restrict file permissions on Unix systems

Summary AWS CLI is a command line tool for interacting with AWS services. When the clihistory feature is enabled, the history database file is created with default permissions, potentially allowing other local users on a multi-user system to read the file. Impact When clihistory is enabled, AWS C...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the clihistory feature. An attacker can access sensitive command history and API request/response data by reading the history database file if it is created with default permissions on a multi-user Unix...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: gitsign, kyverno, crossplane-provider-aws-sqs, gitlab-runner, scorecard, crossplane-provider-aws-ec2, helm, melange, crossplane-provider-aws-cloudformation, apko, argo-events, dagger, flux, wal-g, boring-registry, flux-kustomize-controller, cilium-cli, q, argo-cd,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitsign, kyverno, crossplane-provider-aws-sqs, gitlab-runner, scorecard, crossplane-provider-aws-ec2, helm, melange, crossplane-provider-aws-cloudformation, apko, argo-events, dagger, flux, wal-g, boring-registry, flux-kustomize-controller, cilium-cli, q, argo-cd,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: k9s, helm-fips, rancher-fleet, grype-fips, terraform-provider-azuread-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-aws-lambda-fips, crossplane-provider-aws-iam, gitlab-rails-ce, crossplane-provider-aws-cloudwatchlogs-fips,...

EUVD-2026-8646

Budibase: Remote Code Execution via Unsafe eval in View Filter Map Function Budibase Cloud...

GHSA-XH87-MX6M-69F3 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Summary When using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For header. Because AWS ALB appends the real client IP address to the end of the X-Forwarded-For header, the first...

Ubuntu: Security Advisory (USN-8015-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8013-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-25492

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: runc, kubernetes-dashboard-auth, timestamp-authority, mongodb-kubernetes-operator, aws-sigv4-proxy, cloud-sql-proxy, knative-client, kube-bench, direnv, helm, s5cmd, newrelic-nri-statsd, fluxcd-kustomize-mutating-webhook, aws-application-networking-k8s, promxy, wal-g...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: velero, runc, kubernetes-dashboard-auth, timestamp-authority, mongodb-kubernetes-operator, linkerd2-proxy-init, aws-sigv4-proxy, cloud-sql-proxy, knative-client, kube-bench, direnv, helm, s5cmd, newrelic-nri-statsd, fluxcd-kustomize-mutating-webhook,...