EUVD-2026-51271

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers...

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

acmer (>=0.0.1, <=0.0.4), auth-proxy (>=0.0.1, <=0.1.1) +458 more potentially affected by CVE-2026-18140 via aws-smithy-json (>=0.27.0-alpha.1, <=0.56.1)

aws-smithy-json CARGO version =0.27.0-alpha.1, =0.0.1, =0.0.1, =0.0.1, =0.0.22-alpha, =0.0.1, =0.0.1, =0.1.0, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.34.0 and more Source cves: CVE-2026-18140 Source advisory: OSV:GHSA-8FFR-XGWF-X...

GHSA-8FFR-XGWF-XJ56 aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

LOAD

مقدمة مبني على AWS-Redteam-Lab و OCD GOAD تبلغ تكلفة تشغيل المختبر لمدة 125 ساعة خلال شهر واحد حوالي 14$. مع الطبقة المجانية تحصل على 750 ساعة من EC2 شهريًا، وهناك 6 أجهزة لذا 125 ساعة. لكنك تحصل على 30 جيجابايت فقط من التخزين. لذا تحتاج إلى تخزين للأجهزة الخمسة الأخرى: 30 جيجابايت 5 = 150 جيجابا...

awsScrape

AWSScrape AWSScrape هي أداة مصممة لسحب شهادات SSL من جميع نطاقات عناوين AWS، والبحث عن كلمات مفتاحية محددة في حقول الاسم الشائع CN، والمنظمة O، والوحدة التنظيمية OU الخاصة بالشهادات. التثبيت 1. استنسخ هذا المستودع: git clone https://github.com/jhaddix/awsscrape.git cd awsscrape الاستخدام قم بتشغي...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, helm-push, kyverno-notation-aws, maru, helm-mapkubeapis, k9s, kargo, kube-arangodb, opentofu, rancher-helm, gitness, helm-set-status, k8sgpt, tigera-operator, xeol, flux-helm-controller, manifest-tool, cert-manager-cmctl...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, helm-push, kyverno-notation-aws, maru, helm-mapkubeapis, k9s, kargo, kube-arangodb, opentofu, rancher-helm, gitness, helm-set-status, k8sgpt, tigera-operator, xeol, flux-helm-controller, manifest-tool, cert-manager-cmctl...

Cloud-Penetration-Testing-Guide

☁️ Cloud Penetration Testing Guide - Completo Guia operaciona...

CVE-2026-103958

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103956

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958

Loom for AWS versions before 1.7.0 are vulnerable to a Server-side request forgery (SSRF) in the tool server and remote agent connection handling. An authenticated remote user can exploit this by supplying a crafted connection address during the registration, updating, or testing of a tool server...

EUVD-2026-91773

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

EUVD-2026-91772

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957

A Server-side request forgery (SSRF) vulnerability exists in the OAuth2 discovery handling of Loom for AWS versions prior to 1.7.0 . An authenticated remote user can exploit this by supplying a crafted discovery document address when registering a tool server or remote agent configured for delega...