amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0), gherkai-worker-novaact (>=1.4.0, <=1.4.9) +4 more potentially affected by CVE-2026-78379 via strands-agents-tools (>=0.1.9, <=0.2.22)

strands-agents-tools PYPI version =0.1.9, =1.0.60.0, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-78379 Source advisory: SNYK:PYTHON-STRANDSAGENTSTOOLS-19329790...

amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0), gherkai-worker-novaact (>=1.4.0, <=1.4.9) +4 more potentially affected by CVE-2026-78379 via strands-agents-tools (>=0.1.9, <=0.2.22)

strands-agents-tools PYPI version =0.1.9, =1.0.60.0, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-78379 Source advisory: MEND:CVE-2026-78379...

CVE-2026-43499-NAM-AL00

CVE-2026-43499 — GhostLock auf Huawei Nova 9 NAM-AL00 Sicherheitsforschung: Bestätigung auf dem Gerät und Exploit-Analyse von CVE-2026-43499 GhostLock auf Huawei Nova 9 NAM-AL00, Snapdragon 778G/SM7325, HarmonyOS 4.2.0.185, Kernel 5.4.86-qgki. Zusammenfassung CVE-2026-43499 ist ein...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 — GhostLock on Huawei Nova 9 NAM-AL00 Securi...

CVE-2026-71491 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-glance-2025.1, openstack-horizon-2025.1, openstack-glance-2025.2-fips, openstack-nova-2025.1, openstack-horizon-2026.1, openstack-placement-2025.2, airflow, openstack-placement-2025.1,...

GHSA-F2FF-P2WW-7P4P vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-glance-2025.1, openstack-horizon-2025.1, openstack-glance-2025.2-fips, openstack-nova-2025.1, openstack-horizon-2026.1, openstack-placement-2025.2, airflow, openstack-placement-2025.1,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: amazon-k8s-cni-fips, flux-fips, metacontroller, dkron, flux-source-watcher, grafana-operator-fips, victoriametrics, flux-source-controller, victorialogs, flux-operator-fips, librechat, victoriametrics-fips, aws-load-balancer-controller-fips, pluto, grafana-fips,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: falcoctl, opentofu, cloud-sql-proxy, aws-application-networking-k8s, cluster-api-helm-controller, nri-mysql, azure-service-operator, libnvidia-container, chartmuseum, helm-push, docker-machine-driver-harvester, envconsul, kube-bench, cis-operator, nri-nginx,...

openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw...

amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0), gherkai-worker-novaact (>=1.4.0, <=1.4.9) +4 more potentially affected by CVE-2026-19111 via strands-agents-tools (>=0.1.9, <=0.2.22)

strands-agents-tools PYPI version =0.1.9, =1.0.60.0, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-19111 Source advisory: SNYK:PYTHON-STRANDSAGENTSTOOLS-18592366...

amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0), gherkai-worker-novaact (>=1.4.0, <=1.4.9) +4 more potentially affected by CVE-2026-19111 via strands-agents-tools (>=0.1.9, <=0.2.22)

strands-agents-tools PYPI version =0.1.9, =1.0.60.0, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-19111 Source advisory: MEND:CVE-2026-19111...

agentstack-cli (>=0.6.2rc2, <=0.7.1), amiibo-converter (0.2.0) +149 more potentially affected by CVE-2026-69248 via cryptography (46.0.5)

cryptography PYPI version 46.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - agentstack-cli =0.6.2rc2, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.3, =3.14.12, =3.1.0, =3.7.4 and more Source cves: CVE-2026-69248...

amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0), gherkai-worker-novaact (>=1.4.0, <=1.4.9) +4 more potentially affected by CVE-2026-18733 via strands-agents-tools (>=0.1.9, <=0.2.22)

strands-agents-tools PYPI version =0.1.9, =1.0.60.0, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-18733 Source advisory: MEND:CVE-2026-18733...

amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0), gherkai-worker-novaact (>=1.4.0, <=1.4.9) +4 more potentially affected by CVE-2026-18394 via strands-agents-tools (>=0.1.9, <=0.2.22)

strands-agents-tools PYPI version =0.1.9, =1.0.60.0, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-18394 Source advisory: MEND:CVE-2026-18394...

agi-cluster (>=2026.6.18, <=2026.7.4), agi-core (>=2026.6.18, <=2026.7.4) +115 more potentially affected by CVE-2026-59890 via setuptools (82.0.1)

setuptools PYPI version 82.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - agi-cluster =2026.6.18, =2026.6.18, =2026.6.18, =0.2.4, =1.1.0, =1.76.1, =7.0.8, =1.0.0, =1.3.29, =0.0.1, =4.5.65, =4.5.67 and more Source...

amazon-nova-act-mcp (>=1.0.60.0, <=1.20260527102944.0), gherkai-worker-novaact (>=1.4.0, <=1.4.9) +4 more potentially affected by CVE-2026-15746 via strands-agents-tools (>=0.1.9, <=0.2.22)

strands-agents-tools PYPI version =0.1.9, =1.0.60.0, =1.4.0, =2.3.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-15746 Source advisory: MEND:CVE-2026-15746...

OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

Affects- Nova: =18.0.0 =32.0.0 =33.0.0 33.0.2 DescriptionErichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling...

PYSEC-2026-2686 OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

Affects - Nova: =18.0.0 =32.0.0 =33.0.0 33.0.2 Description Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling...

amzn-nova-customization-sdk (1.3.14), amzn-nova-forge (>=1.3.14, <=1.3.18) potentially affected by CVE-2026-8597 via sagemaker (3.5.0)

sagemaker PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - amzn-nova-customization-sdk 1.3.14 - amzn-nova-forge =1.3.14, =1.3.18 Source cves: CVE-2026-8597 Source advisory: OSV:PYSEC-2026-3060...

amzn-nova-customization-sdk (1.3.14), amzn-nova-forge (>=1.3.14, <=1.3.18) potentially affected by CVE-2026-8596 via sagemaker (3.5.0)

sagemaker PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - amzn-nova-customization-sdk 1.3.14 - amzn-nova-forge =1.3.14, =1.3.18 Source cves: CVE-2026-8596 Source advisory: OSV:PYSEC-2026-3059...