ShinyHunters Hackers Claim Theft of 3M+ Cisco Records, Threaten Public Leak

ShinyHunters hackers claim they stole 3 million+ Cisco records via Salesforce and AWS, warning of a public leak if demands are not met by April 3, 2026...

SUSE CVE-2026-5190

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages. To remediate this issue, user...

Ubuntu: Security Advisory (USN-8143-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CLEANSTART-2026-JB52011 Security fixes for CVE-2025-47911, CVE-2025-58190, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-p77j-4mvh-x3m3 applied in versions: 1.11.1-r1, 1.11.1-r2

Multiple security vulnerabilities affect the velero-plugin-for-aws package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: mount-s3

Issue Overview: time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used...

PT-2026-56753

Multiple security vulnerabilities affect the velero-plugin-for-aws package. These issues are resolved in later releases. See references for individual vulnerability details...

OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Summary Host execution env sanitization did not block GITTEMPLATEDIR or AWSCONFIGFILE, even though both can redirect trusted tooling to attacker-controlled content. Impact An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute untrust...

GHSA-M866-6QV5-P2FG OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Summary Host execution env sanitization did not block GITTEMPLATEDIR or AWSCONFIGFILE, even though both can redirect trusted tooling to attacker-controlled content. Impact An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute untrust...

aws-athena-mcp (1.0.1), fabric-lakehouse-mcp (>=0.3.1, <=0.3.15) +7 more potentially affected by CVE-2026-32871 via fastmcp (2.5.2)

fastmcp PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aws-athena-mcp 1.0.1 - fabric-lakehouse-mcp =0.3.1, =0.1.17, =0.32.2, =0.0.1, =0.1.6, =0.1.9 Source cves: CVE-2026-32871 Source advisory:...

CVE-2026-5190 AWS C Event Stream Streaming Decoder Stack Buffer Overflow

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages. To remediate this issue, user...

CVE-2026-5190

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages. To remediate this issue, user...

ais-dom (>=0.109.0b0, <=0.109.7), aws-gate (0.8.8) +10 more potentially affected by CVE-2026-34073 via cryptography (2.9.0)

cryptography PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.109.0b0, =0.3.0a0, =0.109.0b0, =2.0.0rc1, =2.3.7, =1.37.1, =1.37.8 - tornado-widgets 0.0.17 Source cves: CVE-2026-34073 Sourc...

atlassian-jwt-auth (8.0.1), authx (>=0.0.3, <=0.0.5) +28 more potentially affected by CVE-2026-34073 via cryptography (3.1.1)

cryptography PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 8.0.1 - authx =0.0.3, =0.9.1, =1.0.0, =0.8.2rc2, =3.20.0, =0.1.0a1, =0.0.1, =0.0.7, =0.0.5, =0.1.0a1, =0.1.0a4 and mo...

langchain-anthropic (>=0.2.0.dev0, <=0.2.0.dev1), langchain-aws (0.2.0.dev1) +12 more potentially affected by CVE-2026-34070 via langchain-core (0.4.0.dev0)

langchain-core PYPI version 0.4.0.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langchain-anthropic =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.3.0.dev0, =0.1.0.dev0, =0.1.0.dev1 Source cves:...

CVE-2026-5190: Out-of-bounds Write

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages. To remediate this issue, user...

aws-c-event-stream 安全漏洞

aws-c-event-stream is a C language implementation library for the event stream protocol, open-sourced by Amazon Web Services - Labs. Versions of aws-c-event-stream prior to 0.6.0 contain security vulnerabilities. These vulnerabilities stem from out-of-bounds writing in the stream decoder componen...

PT-2026-32076

Summary Host execution env sanitization did not block GIT TEMPLATE DIR or AWS CONFIG FILE, even though both can redirect trusted tooling to attacker-controlled content. Impact An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CEL-based HTTP functions. An attacker can make unauthorized network requests to internal or external resources and exfitrate sensitive information AWS IAM credentials, GCP tokens by crafting...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CEL-based HTTP functions. An attacker can make unauthorized network requests to internal or external resources and exfitrate sensitive information AWS IAM credentials, GCP tokens by crafting...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, nuclei, aws-otel-collector, crossplane-provider-aws-memorydb, crossplane-provider-family-aws, crossplane-provider-aws-eks, crossplane-provider-azure-authorization, crossplane-provider-aws-sqs, crossplane-provider-aws-route53,...