USN-8630-4 linux-aws-6.8 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Mellanox network drivers; - File systems infrastructur...

GO-2026-6093 vulnerabilities

Vulnerabilities for packages: localstack...

CVE-2026-75910

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

EUVD-2026-63585

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

repokid v0.19.8

Repokid Repokid uses Access Advisor provided by Aardvark to remove permissions granting access to unused services from the inline policies of IAM roles in an AWS account. Getting Started Install root@kitploit: mkvirtualenv repokid git clone [email protected]:Netflix/repokid.git cd repokid pi...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesisanalytics-fips, crossplane-provider-aws-kms, crossplane-provider-aws-cloudfront-fips, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-secretsmanager-fips, crossplane-provider-aws-appintegrations,...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesisanalytics-fips, crossplane-provider-aws-kms, crossplane-provider-aws-cloudfront-fips, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-secretsmanager-fips, crossplane-provider-aws-appintegrations,...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3, kubevela, crossplane-provider-aws-sns, gitness, terraform-provider-grafana, crossplane-provider-aws-cloudfront, crossplane-provider-aws-rds, dataplaneapi, crossplane-provider-aws-ec2, crossplane-provider-family-azure,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure, cluster-api-ipam-provider-in-cluster, external-secrets-operator, kubescape, metallb, hubble-ui, kuma, rancher-system-agent, kube-state-metrics, node-feature-discovery, cluster-api-provider-vsphere, argocd-image-updater, kubeflow-pipelines,...

EUVD-2026-62941

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user...

PT-2026-79118

Name of the Vulnerable Software and Affected Versions Amazon Athena Federated Query ClickHouse connector versions prior to v2026.17.1 Description Incorrect privilege assignment in the deployment template allows an authenticated remote user to read arbitrary AWS Secrets Manager secrets within the...

CVE-2026-75910: Incorrect Privilege Assignment

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive information by accessing logs that may inadvertently contain confidential data. Remediation Upgrade...

CVE-2026-76376

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user...

GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

CVE-2026-76376

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR , a user with permission to run actions can expose sensitive AWS credentials in cleartext through the user interface. The root cause is that the affected action parameter is not marked as a password , so it is not masked when displayed. T...

CVE-2026-76376 Information Disclosure through Action Parameters in AWS IAM app for Splunk SOAR

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user...

CVE-2026-18140

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

Malicious code in chai-as-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90afdde9240783f1f869b875b7967490cf579e1bae0986861498f8c98c0d973 The package advertises itself as a logger README and type definitions copied wholesale from pinojs/pino but its exported middleware is a no-op that...