CLEANSTART-2026-GY32533 Security fixes in velero-plugin-for-aws 1.13.0-r0

Package velero-plugin-for-aws version 1.13.0-r0 fixes 10 vulnerabilities: CVE-2025-47912, CVE-2025-58183, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188...

PT-2026-86017

Package aws-network-policy-agent version 1.3.2-r0 fixes 1 vulnerabilities: ghsa-xmrv-pmrh-hhx2...

PT-2026-66566

Name of the Vulnerable Software and Affected Versions aws-smithy-json versions prior to 0.62.7 Description Uncontrolled recursion occurs in the unknown-key skip path of the runtime crate, which is invoked by the smithy-rs code generator from every generated struct deserializer. This allows remote...

CVE-2026-18245: Improper Control of Generation of Code

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

PT-2026-86011

Package cloud-provider-aws-1.34 version 1.34.1-r1 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wnfv, ghsa-j5w8-q4qc-rx2x...

CVE-2026-18140: Uncontrolled Recursion

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

EUVD-2026-35187

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping...

CVE-2026-63239: Use of Hard-coded Credentials

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...

SUSE CVE-2025-11621

Vault and Vault Enterprise's “Vault” AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise...

Qualys Expands Serverless Security with Vulnerability Scanning for AWS Lambda

Key Takeaways Qualys now delivers automated AWS Lambda vulnerability scanning , extending serverless security beyond posture checks CSPM into workload-level risk visibility. CSPM alone only catches misconfigurations excessive permissions, exposure, logging, encryption — it can't detect vulnerable...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, zot, k3s, kwok, datadog-agent, kubernetes, calico, cluster-api-helm-controller, external-secrets-operator, kubeflow-pipelines, kubernetes-csi-external-snapshotter, kubescape, kube-metrics-adapter, metallb, metrics-server, kyverno-notation-aws,...

openSUSE 16: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (openSUSE-SU-2026:21406-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21406-1 advisory. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate bsc1270542. -...

GHSA-J6G5-3HH3-PGW8 AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...

aws-smithy-http-server-python (>=0.44.0, <=0.52.0) potentially affected by CVE-2026-16756 via aws-smithy-http-server (>=0.44.0, <=0.52.0)

aws-smithy-http-server CARGO version =0.44.0, =0.44.0, =0.52.0 Source cves: CVE-2026-16756 Source advisory: OSV:GHSA-JVXP-QMX7-GJPX...

GHSA-JVXP-QMX7-GJPX Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits...

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits...

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

Summary The AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...

@alfresco/adf-testing (6.0.0-A.2-8258), @genexus/ngx-aws-deploy (5.2.1) +5 more potentially affected by CVE-2026-14257 via brace-expansion (>=2.0.0, <=2.0.1)

brace-expansion NPM version =2.0.0, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-14257 Source advisory: OSV:GHSA-MH99-V99M-4GVG...

@104corp/cdk-aws-codedeploy-on-premises (>=1.0.0, <=1.0.2), @abletest/able (>=0.0.1, <=0.0.4) +274 more potentially affected by unknown CVE via @aws-cdk/aws-codebuild (>=1.75.0, <=1.204.0)

@aws-cdk/aws-codebuild NPM version =1.75.0, =1.0.0, =0.0.1, =0.1.0, =1.0.6, =1.0.0, =1.1.0-GqlExtensibility.1, =1.2.0-geo.0, =0.0.1, =4.13.3-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =1.1.0-ext1.0, =1.75.0, =1.0.0, =1.204.0 and more Source cves: unknown CVE Source advisory:...