USN-8433-1: OpenStack Keystone vulnerabilities

It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the role restrictions imposed on the application credential. CVE-2026-33551 It was discovered...

SSRF (Server-Side Request Forgery) axios Dependency in Bitbucket Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 9.4.12, 10.2.0, and 10.3.0 of Bitbucket Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows ...

org.jenkins-ci.main:jenkins-test-harness (1.570), org.jenkins-ci.main:jenkins-war (1.570) +6 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.570)

org.jenkins-ci.main:jenkins-core MAVEN version 1.570 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.570 - org.jenkins-ci.main:jenkins-war 1.570 -...

au.com.versent.jenkins.plugins:ignore-committer-strategy (>=55.v51410e712e0c, <=63.v7e87d06b_a_30c), com.amazon.jenkins.fleet:ec2-fleet (>=4.1.0.506.v619d63b_ec9d8, <=4.5.0.564.v1a_1ee286ee9c) +399 more potentially affected by CVE-2026-53441 via org.jenkins-ci.main:jenkins-core (>=2.483, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.483, =55.v51410e712e0c, =4.1.0.506.v619d63bec9d8, =198.vfe106798d1a6, =66.v12c841920f7d, =145.vc4847603833e, =1.281.v331e3f5a05a9, =4204.v2894bcd7b92f, =4204.v2894bcd7b92f, =1.44.0, =219.vaef06807c245, =61.v68bd7264b643, =121.v23de4af2420f,...

org.jenkins-ci.main:jenkins-test-harness (1.570), org.jenkins-ci.main:jenkins-war (1.570) +6 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.570)

org.jenkins-ci.main:jenkins-core MAVEN version 1.570 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.570 - org.jenkins-ci.main:jenkins-war 1.570 -...

org.jenkins-ci.main:jenkins-test-harness (1.529), org.jenkins-ci.main:jenkins-war (1.529) +5 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.529)

org.jenkins-ci.main:jenkins-core MAVEN version 1.529 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.529 - org.jenkins-ci.main:jenkins-war 1.529 -...

com.amazon.jenkins.fleet:ec2-fleet (1.0), com.apica:apicaloadtest (1.0) +40 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.609)

org.jenkins-ci.main:jenkins-core MAVEN version 1.609 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.amazon.jenkins.fleet:ec2-fleet 1.0 - com.apica:apicaloadtest 1.0 -...

org.jenkins-ci.main:jenkins-test-harness (1.570), org.jenkins-ci.main:jenkins-war (1.570) +6 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.570)

org.jenkins-ci.main:jenkins-core MAVEN version 1.570 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.570 - org.jenkins-ci.main:jenkins-war 1.570 -...

org.jenkins-ci.main:jenkins-test-harness (1.538), org.jenkins-ci.main:jenkins-war (1.538) +5 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.538)

org.jenkins-ci.main:jenkins-core MAVEN version 1.538 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.538 - org.jenkins-ci.main:jenkins-war 1.538 -...

CVE-2026-10177

A security vulnerability has been detected in Aider-AI Aider 0.86.3. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has...

GHSA-HCHG-QM84-CJ9P Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

CVE-2026-10177

CVE-2026-10177 affects Aider-AI Aider 0.86.3, specifically the function requests.get in api_docs.py within the AWS EC2 Metadata Endpoint component. The issue enables a server-side request forgery (SSRF) and is exploitable remotely. Public disclosure has occurred, with the vulnerability categorize...

CVE-2026-10177 Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery

A security vulnerability has been detected in Aider-AI Aider 0.86.3. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has...

PT-2026-45187

Name of the Vulnerable Software and Affected Versions Aider-AI Aider version 0.86.3 Description A server-side request forgery SSRF issue exists in the AWS EC2 Metadata Endpoint component. This occurs within the requests.get function located in the api docs.py file, allowing a remote attacker to...

CVE-2026-10177: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in Aider-AI Aider 0.86.3. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has...

Aider code issue vulnerabilities

Aider is an open-source terminal AI pair programming tool developed by Aider AI. Version 0.86.3 of Aider contains a code vulnerability. This vulnerability stems from the requests.get operation in the apidocs.py file of the AWS EC2 Metadata Endpoint, which leads to server-side request forgeing...

org.jenkins-ci.plugins:ec2 (>=1822.v87175d209b_b_5, <=1856.vf40220e7a_75f) potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (642.v737c34dea_6c2)

org.jenkins-ci.plugins:credentials-binding MAVEN version 642.v737c34dea6c2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:ec2 =1822.v87175d209bb5,...

CVE-2026-43001

A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied projectid for an EC2-type credential was not validated against the project of the authenticating...

CVE-2026-42864

FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validatio...