CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: kubevela, docker-cli-buildx, istio, verticadb-operator, k8sgpt, cilium-cli, envoy-gateway, kube-arangodb, headlamp, kiali, cri-tools, helm, velero, cloudnative-pg, sonobuoy, hubble, gitlab-runner, emissary, linkerd2, argocd-image-updater, dynamic-localpv-provisioner,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: headlamp-fips, aws-node-termination-handler, commercial-grafana, kube-arangodb-fips, hubble-fips, argo-workflows-fips, dynamic-localpv-provisioner-fips, kubescape, cloudbeat, cloudbeat-fips, tigera-operator, grafana-fips, cluster-api-fips,...

CVE-2026-6437

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users...

CVE-2026-6437 AWS EFS CSI Driver Mount Option Injection

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users...

CVE-2026-6437

CVE-2026-6437 concerns the AWS EFS CSI Driver (aws-efs-csi-driver) prior to v3.0.1. The flaw is improper neutralization of argument delimiters in the volume handling component, which allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via...

CVE-2026-6437: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users...

aws-credential-process (0.20.0), aws-session-daemon (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2026-40947 via yubikey-manager (>=5.0.0, <=5.1.1)

yubikey-manager PYPI version =5.0.0, =0.1.0, =1.0.0, =1.6.6 Source cves: CVE-2026-40947 Source advisory: SNYK:PYTHON-YUBIKEYMANAGER-16325204...

assemblyline-ui (>=4.2.0.90, <=4.7.5.dev150), aws-adfs (>=2.0.0a2, <=2.13.0) +50 more potentially affected by CVE-2026-40947 via fido2 (>=0.7.3, <=2.1.1)

fido2 PYPI version =0.7.3, =4.2.0.90, =2.0.0a2, =0.13.0, =0.0.1, =0.1.0, =1.1.0, =4.0.7a1, =0.4.0, =0.1.0, =0.3.0, =0.30.0, =3.0.0b2, =0.5.1, =0.3.20, =0.8.3 and more Source cves: CVE-2026-40947 Source advisory: MEND:CVE-2026-40947...

Amazon Linux 2 : amazon-efs-utils, --advisory ALAS2-2026-3245 (ALAS-2026-3245)

The version of amazon-efs-utils installed on the remote host is prior to 3.0.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3245 advisory. time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided t...

com.digitalpebble.stormcrawler:storm-crawler-aws (>=2.0, <=2.11), com.digitalpebble.stormcrawler:storm-crawler-core (>=2.0, <=2.11) +77 more potentially affected by CVE-2026-35337 via org.apache.storm:storm-client (>=2.0.0, <=2.8.5)

org.apache.storm:storm-client MAVEN version =2.0.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.7, =2.0, =2.0, =2.0, =2.1, =2.6.3.1, =2.4.0, =2.4.0, =2.4.0, =2.0.0, =2.8.5 and more Source cves: CVE-2026-35337 Source advisory: OSV:GHSA-JF89-3Q6Q-VCGR...

com.digitalpebble.stormcrawler:storm-crawler-aws (>=2.0, <=2.11), com.digitalpebble.stormcrawler:storm-crawler-core (>=2.0, <=2.11) +77 more potentially affected by CVE-2026-35337 via org.apache.storm:storm-client (>=2.0.0, <=2.8.5)

org.apache.storm:storm-client MAVEN version =2.0.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.7, =2.0, =2.0, =2.0, =2.1, =2.6.3.1, =2.4.0, =2.4.0, =2.4.0, =2.0.0, =2.8.5 and more Source cves: CVE-2026-35337 Source advisory: SNYK:JAVA-ORGAPACHESTORM-16067036...

com.digitalpebble.stormcrawler:storm-crawler-aws (>=2.0, <=2.11), com.digitalpebble.stormcrawler:storm-crawler-core (>=2.0, <=2.11) +77 more potentially affected by CVE-2026-35337 via org.apache.storm:storm-client (>=2.0.0, <=2.8.5)

org.apache.storm:storm-client MAVEN version =2.0.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.7, =2.0, =2.0, =2.0, =2.1, =2.6.3.1, =2.4.0, =2.4.0, =2.4.0, =2.0.0, =2.8.5 and more Source cves: CVE-2026-35337 Source advisory: MEND:CVE-2026-35337...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2026-1564)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1564 advisory. time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via...

Exploit for Server-Side Request Forgery in Vercel Next.Js

CVE-2024-34351 Demo Minimal Next.js 14.0.0 application for de...

EUVD-2026-21656

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handlin...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: karpenter, snyk-cli, cert-manager, k8s-device-plugin, istio, kine, cilium-cli, flux, prometheus, aws-flb-cloudwatch, gitlab-pages, cloud-provider-aws, helm, hubble, kyverno, external-dns, kubernetes-dashboard, mattermost, newrelic-fluent-bit-output, coredns, nerdctl,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: karpenter, stakater-reloader, flux-helm-controller, grafana-rollout-operator, aws-privateca-issuer, omnibump, flux-image-reflector-controller, actions-runner-controller, github-mcp-server, envoy-ratelimit, flux, smarter-device-manager, oras, hubble,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: knative-client, omnibump, cilium-cli, nri-postgresql, crossplane, dockerize, incert, timestamp-authority, kafkaexporter, wave, step, nri-kafka, dfc, trivy-operator, act, aws-s3-controller, memcached-exporter, otel-cli, spegel, vault-env, rancher-webhook, gostatsd,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: knative-client, omnibump, cilium-cli, nri-postgresql, crossplane, dockerize, incert, timestamp-authority, kafkaexporter, wave, step, nri-kafka, dfc, trivy-operator, act, aws-s3-controller, memcached-exporter, otel-cli, spegel, vault-env, rancher-webhook, gostatsd,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: syft, knative-client, flux-helm-controller, k8ssandra-operator, kyverno-policy-reporter-ui, docker-cli-buildx, terraform-provider-azapi, kubernetes-csi-node-driver-registrar, aws-efs-csi-driver, cilium-cli, mc, certificate-transparency, crossplane, flux,...