6497 matches found
CVE-2026-94384
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...
CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...
EUVD-2026-84568
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...
CVE-2026-94384
The Amazon amazon-connect-salesforce-lambda component (versions before 5.26 ) is vulnerable to privilege escalation due to missing authorization in the sfExecuteAWSService function. This allows any IAM principal with lambda:InvokeFunction permissions to perform restricted AWS API operations becau...
CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...
CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...
CVE-2026-94384: Missing Authorization
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...
PT-2026-96855
Name of the Vulnerable Software and Affected Versions Amazon amazon-connect-salesforce-lambda versions prior to 5.26 Description Missing authorization in the Amazon Connect Salesforce integration allows an IAM principal with lambda:InvokeFunction permission to escalate privileges. The...
CVE-2026-79916
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
CVE-2026-79916
MaxKB is an open-source enterprise AI assistant. Prior to 2.10.5-lts , authenticated workspace members can inject control characters into the AWS Bedrock access_key_id and secret_access_key fields. The _update_aws_credentials function writes these values to /root/.aws/credentials without safe par...
CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
EUVD-2026-84153
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
OPENSUSE-SU-2026:21925-1 Security update for keybase-client
This update for keybase-client fixes the following issues: Changes in keybase-client: - CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder...
SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2026:3992-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3992-1 advisory. - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274300. -...
PT-2026-96261
Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.5-lts Description Authenticated workspace members can inject control characters into the AWS Bedrock access key id and secret access key fields. These values are processed by the update aws credentials function and...
PT-2026-96146
Name of the Vulnerable Software and Affected Versions Feast versions prior to 0.65.0 Description The .github/workflows/pr integration tests.yml workflow uses pull request target with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits. This allows ...
CVE-2026-79916: Improper Neutralization of Special Elements used in an OS Command
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
