CVE-2022-23884

CVE-2022-23884 There is a network-layer vulnerabilities in the official server of Minecraft: Bedrock Edition aka Bedrock Server,which allow attacker to launch a DoS attack. CVE-2022-23884 Mojang Bedrock Dedicated Server 1.16.0-1.18.12 is affected by an large loop and crash server caused by...

ai.aarvion:aarvion-sdk-anthropic (>=0.1.0, <=0.2.0), ai.aarvion:aarvion-sdk-apache (>=0.1.0, <=0.2.0) +12910 more potentially affected by CVE-2026-110879 +1 more via com.fasterxml.jackson.core:jackson-databind (>=2.22.0, <=2.22.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.22.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.9.3, =0.9.4, =0.10.0 and more Source cves: CVE-2026-110879, CVE-2026-54512 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONCORE-21761...

ai.aarvion:aarvion-sdk-anthropic (>=0.1.0, <=0.2.0), ai.aarvion:aarvion-sdk-apache (>=0.1.0, <=0.2.0) +12910 more potentially affected by CVE-2026-110879 via com.fasterxml.jackson.core:jackson-databind (>=2.22.0, <=2.22.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.22.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.9.3, =0.9.4, =0.10.0 and more Source cves: CVE-2026-110879 Source advisory: MEND:CVE-2026-110879...

@bedrock/express (8.6.5) potentially affected by CVE-2026-112362 via @fastify/express (4.0.5)

@fastify/express NPM version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/express and may be impacted: - @bedrock/express 8.6.5 Source cves: CVE-2026-112362 Source advisory: SNYK:JS-FASTIFYEXPRESS-21755407...

@bedrock/express (8.6.5) potentially affected by CVE-2026-112362 via @fastify/express (4.0.5)

@fastify/express NPM version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/express and may be impacted: - @bedrock/express 8.6.5 Source cves: CVE-2026-112362 Source advisory: MEND:CVE-2026-112362...

CVE-2026-105812

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-106032

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

agentcore-rl-toolkit (0.1.0) potentially affected by CVE-2026-105812 via bedrock-agentcore-starter-toolkit (0.2.0)

bedrock-agentcore-starter-toolkit PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on bedrock-agentcore-starter-toolkit and may be impacted: - agentcore-rl-toolkit 0.1.0 Source cves: CVE-2026-105812 Source advisory:...

Arbitrary Code Injection

Overview bedrock-agentcore-starter-toolkit is an A starter toolkit for using Bedrock AgentCore Affected versions of this package are vulnerable to Arbitrary Code Injection via the agent import functionality, which incorporates configuration values into generated Python source code without safe...

agentcore-rl-toolkit (0.1.0) potentially affected by CVE-2026-106032 via bedrock-agentcore-starter-toolkit (0.2.0)

bedrock-agentcore-starter-toolkit PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on bedrock-agentcore-starter-toolkit and may be impacted: - agentcore-rl-toolkit 0.1.0 Source cves: CVE-2026-106032 Source advisory:...

Server-side Request Forgery (SSRF)

Overview bedrock-agentcore-starter-toolkit is an A starter toolkit for using Bedrock AgentCore Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unrestricted external OpenAPI reference resolution in the agent import functionality. When processing OpenAPI...

CVE-2026-106032 Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

CVE-2026-106032 Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

CVE-2026-106032

The Amazon Bedrock AgentCore Starter Toolkit is vulnerable to Server-Side Request Forgery (SSRF) and local file read in versions prior to 0.3.14 . The root cause is unrestricted external OpenAPI reference resolution during the processing of the agent import functionality. An authenticated remote ...

EUVD-2026-94002

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

agentcore-rl-toolkit (0.1.0) potentially affected by CVE-2026-106032 via bedrock-agentcore-starter-toolkit (0.2.0)

bedrock-agentcore-starter-toolkit PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on bedrock-agentcore-starter-toolkit and may be impacted: - agentcore-rl-toolkit 0.1.0 Source cves: CVE-2026-106032 Source advisory: MEND:CVE-2026-106032...

CVE-2026-106032

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

CVE-2026-105812

The Amazon Bedrock AgentCore Starter Toolkit before version 0.3.14 is vulnerable to a code injection flaw (CWE-94) within its agent import functionality. The root cause is the lack of safe literal encoding for configuration values when generating Python source code. An authenticated same-account ...

EUVD-2026-94001

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...