CVE-2026-6437

CVE-2026-6437 concerns the AWS EFS CSI Driver (aws-efs-csi-driver) prior to v3.0.1. The flaw is improper neutralization of argument delimiters in the volume handling component, which allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via...

CVE-2026-6437 AWS EFS CSI Driver Mount Option Injection

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users...

Amazon Linux 2 : amazon-efs-utils, --advisory ALAS2-2026-3245 (ALAS-2026-3245)

The version of amazon-efs-utils installed on the remote host is prior to 3.0.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3245 advisory. time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided t...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2026-1564)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1564 advisory. time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via...

Exploit for Server-Side Request Forgery in Vercel Next.Js

CVE-2024-34351 Demo Minimal Next.js 14.0.0 application for de...

EUVD-2026-21656

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handlin...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: pluto, dbmate, actions-runner-controller, github-mcp-server, aws-privateca-issuer, newrelic-k8s-metadata-injection, smokescreen, flux-image-automation-controller, victoriametrics, oras, volume-modifier-for-k8s, mariadb-operator, envoy-ratelimit, karpenter,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: gitlab-kas, newrelic-fluent-bit-output, kubernetes-dashboard, coredns, argo-cd, kubernetes, kubescape, kube-fluentd-operator, karpenter, go, kyverno, redka, falco-no-driver, cilium-cli, hubble, nerdctl, cilium, prometheus-operator, chezmoi, dask-gateway, mattermost,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: crossplane-provider-sql, oras, atlantis, nsc, hubble, temporal, helm-push, rancher-agent, gatus, sftpgo-plugin-auth, victoriametrics-operator, flux-image-reflector-controller, pvc-autoresizer, aws-s3-controller, swagger, q, argo-workflows, influx, pguser,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, terraform-provider-sendgrid, kubernetes-event-exporter, kubernetes, otel-cli, crossplane-provider-sql, nuclei, argocd-image-updater, gitaly, oauth2-proxy, kwok, prometheus-adapter, certificate-transparency, atlantis,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, terraform-provider-sendgrid, kubernetes-event-exporter, kubernetes, otel-cli, crossplane-provider-sql, nuclei, argocd-image-updater, gitaly, oauth2-proxy, kwok, prometheus-adapter, certificate-transparency, atlantis,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: crossplane-provider-sql, oras, atlantis, nsc, hubble, temporal, helm-push, rancher-agent, gatus, sftpgo-plugin-auth, victoriametrics-operator, flux-image-reflector-controller, pvc-autoresizer, aws-s3-controller, swagger, q, argo-workflows, influx, pguser,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: crossplane-provider-sql, oras, atlantis, nsc, hubble, temporal, helm-push, rancher-agent, gatus, sftpgo-plugin-auth, victoriametrics-operator, flux-image-reflector-controller, pvc-autoresizer, aws-s3-controller, swagger, q, argo-workflows, influx, pguser,...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: cert-manager-fips, prometheus-operator, cloud-provider-azure, mattermost, azuredisk-csi, knative-operator-fips, aws-load-balancer-controller-fips, kube-state-metrics, terraform, aactl, backup-restore-operator, newrelic-fluent-bit-output-fips, k9s-fips, gitaly,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: listmonk, supercronic, goreleaser, oras, flux-image-automation-controller-fips, atlas, secrets-store-csi-driver-provider-aws, nodetaint-fips, fluxcd-kustomize-mutating-webhook, kyverno-policy-reporter-plugins-kyverno, commercial-expanso-edge,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: prometheus-operator, seaweedfs-fips, aws-load-balancer-controller-fips, kube-state-metrics, kpt, regclient-fips, aactl, paranoia, gitaly, atlas, tigera-operator, xeol-fips, external-dns, scorecard, atlas-fips, kube-fluentd-operator, openbao, k8ssandra-client,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: prometheus-operator, seaweedfs-fips, aws-load-balancer-controller-fips, kube-state-metrics, kpt, regclient-fips, aactl, paranoia, gitaly, atlas, tigera-operator, xeol-fips, external-dns, scorecard, atlas-fips, kube-fluentd-operator, openbao, k8ssandra-client,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: nri-redis, prometheus-operator, spiffe-helper, seaweedfs-fips, aws-load-balancer-controller-fips, kube-state-metrics, kpt, nri-consul-fips, regclient-fips, supercronic, aactl, vale, paranoia, flux-image-automation-controller-fips, gitaly, knative-storage-migrate,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: checksec, kpt, flux-image-automation-controller-fips, gitaly, gitea, crossplane-function-go-templating, ucd, kubeflow, cyberark-secrets-provider-for-k8s-fips, sealed-secrets-fips, crossplane-provider-aws-backup, aws-iam-authenticator, openbao,...

CVE-2026-5059

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handlin...