CVE-2026-44308

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

CVE-2026-7191

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

CVE-2026-9133

Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme arn:aws-debug:file accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the...

CVE-2026-11401

The CVE-2026-11401 entry describes an untrusted search path vulnerability in the GlobalDatabasePlugin of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL. A remote authenticated low-privilege actor can escalate to other Amazon RDS user privileges (including rds_superuser) via a crafted fu...

CVE-2026-11400 Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...

CVE-2026-11400: Untrusted Search Path

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...

CVE-2026-11401: Untrusted Search Path

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: zarf, kubeflow-pipelines, cloudnative-pg, crossplane-provider-aws-ec2, terraform-provider-grafana, manifest-tool, aws-flb-kinesis, descheduler, jitsucom-bulker, octo-sts, fuse-overlayfs-snapshotter, kaniko, opa-envoy, slsa-verifier, grafana, pgpool2exporter, cri-tool...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: zarf, kubeflow-pipelines, cloudnative-pg, crossplane-provider-aws-ec2, terraform-provider-grafana, manifest-tool, aws-flb-kinesis, descheduler, jitsucom-bulker, octo-sts, fuse-overlayfs-snapshotter, kaniko, opa-envoy, slsa-verifier, grafana, pgpool2exporter, cri-tool...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: zarf, kubeflow-pipelines, cloudnative-pg, crossplane-provider-aws-ec2, terraform-provider-grafana, manifest-tool, aws-flb-kinesis, descheduler, jitsucom-bulker, octo-sts, fuse-overlayfs-snapshotter, kaniko, opa-envoy, slsa-verifier, grafana, pgpool2exporter, cri-tool...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: zarf, kubeflow-pipelines, cloudnative-pg, crossplane-provider-aws-ec2, terraform-provider-grafana, manifest-tool, aws-flb-kinesis, descheduler, jitsucom-bulker, octo-sts, fuse-overlayfs-snapshotter, kaniko, opa-envoy, slsa-verifier, grafana, pgpool2exporter, cri-tool...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: gpu-operator-fips, kubo, fairwinds-gemini-fips, vault-fips, witness, frankenphp-8.4, nats-server-fips, kiali, knative-eventing-fips, gatus, rancher-fleet, sonobuoy-fips, sops, crossplane-provider-aws-cloudsearch, rabbitmq-cluster-operator, opensearch-datasource-fips,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: gpu-operator-fips, kubo, fairwinds-gemini-fips, vault-fips, witness, frankenphp-8.4, nats-server-fips, kiali, knative-eventing-fips, gatus, rancher-fleet, sonobuoy-fips, sops, crossplane-provider-aws-cloudsearch, rabbitmq-cluster-operator, opensearch-datasource-fips,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: gpu-operator-fips, kubo, fairwinds-gemini-fips, vault-fips, witness, frankenphp-8.4, nats-server-fips, kiali, knative-eventing-fips, gatus, rancher-fleet, sonobuoy-fips, sops, crossplane-provider-aws-cloudsearch, rabbitmq-cluster-operator, opensearch-datasource-fips,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: gpu-operator-fips, kubo, fairwinds-gemini-fips, vault-fips, witness, frankenphp-8.4, nats-server-fips, kiali, knative-eventing-fips, gatus, rancher-fleet, sonobuoy-fips, sops, crossplane-provider-aws-cloudsearch, rabbitmq-cluster-operator, opensearch-datasource-fips,...

CVE-2026-49204: Use of Hard-coded Credentials

Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation...

CVE-2026-10843: Execution with Unnecessary Privileges

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise...

PT-2026-46192

Name of the Vulnerable Software and Affected Versions OpenShift Cloud Credential Operator affected versions not specified Description A flaw exists in the Mint-mode IAM policies for AWS within the OpenShift Cloud Credential Operator. Operator credentials are provisioned with account-wide scope fo...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...