6510 matches found
CVE-2026-18953
CVE-2026-18953 affects the Amazon awslabs.aws-transform-mcp-server package (versions 0.1.0–0.1.4). The issue is an improper limitation of a pathname to a restricted directory in the get_resource tool, which could allow a context-dependent actor to write arbitrary files outside the intended workin...
CVE-2026-17578
Kong Event Gateway vulnerable components: versions 1.0.0–1.1.1 and 1.2.0 fail to enforce key rotation before reaching the NIST SP 800-38D usage limit for AES-GCM keys when AWS IAM encryption is enabled. Under sustained high message rates that trigger a reboot without rotation, nonce collisions be...
MAL-2026-12085 Malicious code in @wethenorth12/bip39-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...
Malicious code in @wethenorth12/bip39-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...
PT-2026-68094
Name of the Vulnerable Software and Affected Versions Kong Event Gateway versions 1.0.0 through 1.1.1 Kong Event Gateway version 1.2.0 Description When the AWS IAM encryption feature is enabled, the software fails to enforce key rotation before reaching the NIST SP 800-38D recommended usage limit...
SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:3473-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3473-1 advisory. This update for aws-iam-authenticator fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...
CVE-2026-18954: Incorrect Authorization
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...
PT-2026-68312
Name of the Vulnerable Software and Affected Versions Amazon AWS Labs DocumentDB MCP Server versions prior to 1.0.12 Description Incorrect authorization in the aggregation pipeline tool allows an authenticated MCP client to perform unauthorized write operations on the connected database. This...
PT-2026-68282
Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeBuild Plugin versions prior to 0.60 Description Missing permission checks allow users with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Recommendations Update Jenkins AWS CodeBuild Plug...
CVE-2026-70447: Missing Authorization
Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-17578: Reusing a Nonce, Key Pair in Encryption
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...
Jenkins plugins Multiple Vulnerabilities (2026-08-05)
According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2... CVE-2026-70426 - Jenkins 2.575 and...
Malicious code in @servicetitan/measure-sheet-data (npm)
npm/@servicetitan/measure-sheet-data is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized an...
MAL-2026-11720 Malicious code in @or-sdk/pgsql (npm)
npm/@or-sdk/pgsql is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...
MAL-2026-11671 Malicious code in @or-sdk/apps (npm)
npm/@or-sdk/apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the...
CLSA-2026-1783904626 TuxCare security update for aws/aws-sdk-php (1 CVE)
TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p3+tuxcare...
CLSA-2026-1769993567 TuxCare security update for aws/aws-sdk-php (1 CVE)
TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p1+tuxcare...
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
SummaryThe AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...
PYSEC-2026-3548 AWS CLI: Overly permissive File Permissions
Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...