aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling vulnerability discovered by ? in WordPress Npm aws-cdk-lib versions 2.260.0...

GHSA-VCRF-J523-4MRF aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...

SUSE-SU-2026:3152-1 Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270542. - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrapkey bsc1270705. -...

Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270542. CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrapkey bsc1270705. CVE-2026-41681:...

CLEANSTART-2026-ZL11893 Security fixes for CVE-2026-41080, CVE-2026-45186 applied in versions: 2.35.9-r1, 2.35.9-r2

Multiple security vulnerabilities affect the aws-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UP30431 Security fixes for CVE-2026-41080, CVE-2026-45186 applied in versions: 2.35.9-r1, 2.35.9-r2

Multiple security vulnerabilities affect the aws-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XA09439 Security fixes for CVE-2026-41080, CVE-2026-45186 applied in versions: 2.35.9-r1, 2.35.9-r2

Multiple security vulnerabilities affect the aws-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ID74762 Security fixes for CVE-2026-41080, CVE-2026-45186 applied in versions: 2.35.9-r1, 2.35.9-r2

Multiple security vulnerabilities affect the aws-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

@alfresco/adf-testing (6.0.0-A.2-8258), @genexus/ngx-aws-deploy (5.2.1) +5 more potentially affected by CVE-2026-13149 via brace-expansion (>=2.0.0, <=2.0.1)

brace-expansion NPM version =2.0.0, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-13149 Source advisory: OSV:GHSA-3JXR-9VMJ-R5CP...

GHSA-24F9-69R4-VR33 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-gcp, linux-qemu, linux-vmware, linux-aws...

CVE-2026-52975 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-gcp, linux-qemu, linux-vmware, linux-aws...

CVE-2026-46412

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identified CVE-2026-11400, an issue in Aurora PostgreSQL using the AWS Advanced JDBC Wrapper Impact An issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege...

EUVD-2026-34900

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance...

CVE-2026-15415: Relative Path Traversal

AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research. Improper limitation of a pathname to a restricted directory...

Malicious code in @across-toolkit/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7f4d3a8ae39148bf9964aef6bfe64bc57393c27a28d8e953b30c92442c4b33 @across-toolkit/[email protected] runs a postinstall.js script on npm install that harvests installer-side secrets and posts them to a hardcoded...

Malicious code in @across-toolkit/typescript-config (npm)

The npm package @across-toolkit/typescript-config is a dependency-confusion credential stealer targeting developers of Across Protocol across.to. It masquerades as an internal ESLint/TypeScript config for the across.to toolkit and publishes an implausibly high version 99.0.0 so that a misconfigur...

PT-2026-60522

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and...