261 matches found
CVE-2026-119301
A flaw was found in AWS SDK for pandas awswrangler. An authenticated remote user with permissions to modify AWS Glue Data Catalog metadata can supply a crafted column name to exploit improper quoting syntax neutralization when SQL identifiers are constructed in the Apache Iceberg write component...
CVE-2026-119301 Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas also published as awswrangler 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any tab...
CVE-2026-119301 Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas also published as awswrangler 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any tab...
CVE-2026-119301
The AWS SDK for pandas (also known as awswrangler ), versions 3.5.2 through 3.17.0 , is vulnerable to improper neutralization of quoting syntax in SQL identifier construction within the Apache Iceberg write component. An authenticated remote user with permissions to modify AWS Glue Data Catalog m...
matano
Open source security data lake for AWS Matano Open Source Security data lake is an open source cloud-native security data lake , built for security teams on AWS. !NOTE Matano offers a commercial managed Cloud SIEM for a complete enterprise Security Operations platform. Learn more. Docs | Website ...
CVE-2026-119301: AWS aws-sdk-pandas: Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS…
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas also published as awswrangler 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any tab...
io.kestra.plugin:plugin-jdbc-snowflake (>=0.16.0, <=0.16.1), io.squashql:squashql-snowflake (>=1.17.1, <=1.18.2) +2 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.15.1)
net.snowflake:snowflake-jdbc MAVEN version 3.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.kestra.plugin:plugin-jdbc-snowflake =0.16.0, =1.17.1, =445, =446 Source cves: CVE-2026-86597 Source...
io.github.deepakvijayakumar14:kotlin-snowflake (>=0.2.0, <=0.3.0), io.squashql:squashql-snowflake (>=1.19.0, <=1.19.10) +2 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.16.0)
net.snowflake:snowflake-jdbc MAVEN version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.github.deepakvijayakumar14:kotlin-snowflake =0.2.0, =1.19.0, =447, =447, =449 Source cves:...
io.trino:trino-iceberg (>=464, <=468), io.trino:trino-snowflake (>=464, <=468) +4 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.19.1)
net.snowflake:snowflake-jdbc MAVEN version 3.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.trino:trino-iceberg =464, =464, =1.7.0, =10.6.32, =10.6.32, =10.6.32, =10.6.34 Source cves:...
com.codbex.atlas:codbex-atlas-application (>=2.2.0, <=2.10.0), com.codbex.hades:codbex-hades-application (>=2.2.0, <=2.10.0) +15 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.23.0)
net.snowflake:snowflake-jdbc MAVEN version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0, =2.2.0, =11.7.0,...
com.codbex.atlas:codbex-atlas-application (>=1.4.0, <=2.1.0), com.codbex.hades:codbex-hades-application (>=1.6.0, <=2.1.0) +17 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.22.0)
net.snowflake:snowflake-jdbc MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =1.4.0, =1.6.0, =2.0.0, =1.6.0, =1.4.0, =1.3.0, =1.6.0, =470...
io.trino:trino-iceberg (>=454, <=456), io.trino:trino-snowflake (>=454, <=456) +7 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.18.0)
net.snowflake:snowflake-jdbc MAVEN version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.trino:trino-iceberg =454, =454, =2.2.1, =10.6.19, =0.1.0, =16.22.1, =16.22.1, =16.22.1, =16.22.1,...
CVE-2026-97395
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...
CVE-2026-97395 Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...
CVE-2026-97395
In Apache Polaris versions
EUVD-2026-88960
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...
CVE-2026-97395
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...
CVE-2026-97395 Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...
CVE-2026-97395: Missing Authorization
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...
