CVE-2026-11417 OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 2.246.0 on Windows might allow an actor who controls the value of one or more bundling properties externalModules, define, loader, inject, or esbuildArgs to execute arbitrary commands on the host...

CVE-2026-11417 OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 2.246.0 on Windows might allow an actor who controls the value of one or more bundling properties externalModules, define, loader, inject, or esbuildArgs to execute arbitrary commands on the host...

PT-2026-48489

Name of the Vulnerable Software and Affected Versions aws-cdk-lib versions prior to 2.245.0 aws-cdk-lib versions prior to 2.246.0 Windows Description OS command injection exists in the NodejsFunction local bundling pipeline. An actor who controls the value of one or more bundling...

CVE-2026-11393 Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of anothe...

OPENSUSE-SU-2026:20928-1 Security update for syft

This update for syft fixes the following issues: Changes in syft: - Update to version 1.45.0: Added Features - Add support for ZapAddOns as jar files 4654 4932 @douglasclarke - MySQL binary classifier should distinguish between MySQL Cluster ndb and MySQL 3297 4907 @witchcraze - Catalog...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Untrusted Search Path

Overview Affected versions of this package are vulnerable to Untrusted Search Path in the GlobalAuroraPgDatabaseDialect, which is included in the public schema. A low-privileged user can elevate privileges to rdssuperuser by creating a malicious function that executes when another user connects t...

CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-44308

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

CVE-2026-7191

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

CVE-2026-9133

Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme arn:aws-debug:file accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the...

CVE-2026-11401

The CVE-2026-11401 entry describes an untrusted search path vulnerability in the GlobalDatabasePlugin of the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL. A remote authenticated low-privilege actor can escalate to other Amazon RDS user privileges (including rds_superuser) via a crafted fu...

CVE-2026-11400 Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, telegraf, grafana-rollout-operator, cri-tools, terraform-docs, frp, kubevela, stakater-reloader, bento, crossplane-provider-aws-cloudformation, volume-modifier-for-k8s, container-object-storage-interface, addon-resizer, ctop, sops, conjur-cli,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, telegraf, grafana-rollout-operator, cri-tools, terraform-docs, frp, kubevela, stakater-reloader, bento, crossplane-provider-aws-cloudformation, volume-modifier-for-k8s, container-object-storage-interface, addon-resizer, ctop, sops, conjur-cli,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, telegraf, grafana-rollout-operator, cri-tools, terraform-docs, frp, kubevela, stakater-reloader, bento, crossplane-provider-aws-cloudformation, volume-modifier-for-k8s, container-object-storage-interface, addon-resizer, ctop, sops, conjur-cli,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: neuvector-scanner, telegraf, grafana-rollout-operator, cri-tools, terraform-docs, frp, kubevela, stakater-reloader, bento, crossplane-provider-aws-cloudformation, volume-modifier-for-k8s, container-object-storage-interface, addon-resizer, ctop, sops, conjur-cli,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, crossplane-provider-aws-opensearch-fips, kube-state-metrics, mig-parted, commercial-expanso-edge, crossplane-provider-azure-authorization, kubevela, terraform-provider-grafana, trillian-fips, crossplane-provider-aws-s3control-fips, envconsul-fip...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, crossplane-provider-aws-opensearch-fips, kube-state-metrics, mig-parted, commercial-expanso-edge, crossplane-provider-azure-authorization, kubevela, terraform-provider-grafana, trillian-fips, crossplane-provider-aws-s3control-fips, envconsul-fip...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, crossplane-provider-aws-opensearch-fips, kube-state-metrics, mig-parted, commercial-expanso-edge, crossplane-provider-azure-authorization, kubevela, terraform-provider-grafana, trillian-fips, crossplane-provider-aws-s3control-fips, envconsul-fip...