CVE-2026-38808

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...

OPENSUSE-SU-2026:10872-1 amazon-ssm-agent-3.3.4515.0-1.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4515.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-38808

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...

CVE-2026-38808

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...

PT-2026-44049

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...

CVE-2026-38808

CVE-2026-38808 is a SQL Injection vulnerability affecting uzy-ssm-mall v1.1.0. The issue is reachable via the ProductMapper.xml and OrderUtil.java components, enabling a remote attacker to obtain sensitive information. The CVSS 3.1 vector indicates network access, low attack complexity, no privil...

CVE-2026-38808

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...

CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...

CVE-2026-42526

The CVE-2026-42526 vulnerability affects apache-airflow-providers-amazon backends for AWS Secrets Manager and SSM Parameter Store prior to 9.28.0. The team-scoping logic could resolve a conn_id containing a slash (for example a_team/conn) to the same path as another team’s secret when the caller ...

PT-2026-42004

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.28.0 Description In the AWS Secrets Manager and SSM Parameter Store secrets backends, the team-scoping logic could resolve a conn id containing a / for example, "my team/conn" to the same pat...

OPENSUSE-SU-2026:10765-1 amazon-ssm-agent-3.3.4268.0-2.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4268.0-2.1 package on the GA media of openSUSE Tumbleweed...

ebes (>=0.0.0 <=0.0.3), helical (>=0.0.1a8 <=0.0.1a9) +2 more potentially affected by CVE-2026-31239 via mamba-ssm (>=1.0.1 <=2.2.5)

mamba-ssm PYPI version =1.0.1, =0.0.0, =0.0.1a8, =1.0.0, =1.2.0 - ml-trainer-sdk =0.1.0 Source cves: CVE-2026-31239 Source advisory: OSV:GHSA-PQ2F-X424-6FJM...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller-fips, kots, flux-image-automation-controller, jfrog-cli, syft, external-secrets-operator, trivy, kargo, crossplane-fips, crossplane, grafana-alloy, snyk-cli, gitlab-rails-ce, zarf-fips, pulumi-language-yaml, dagger, trufflehog-fips,...

tough-kms (>=0.2.0 <=0.5.0), tough-ssm (>=0.5.0 <=0.8.0) +1 more potentially affected by CVE-2026-6966 via tough (>=0.10.0 <=0.1.0)

tough CARGO version =0.10.0, =0.2.0, =0.5.0, =0.1.0, =0.9.0 Source cves: CVE-2026-6966 Source advisory: OSV:GHSA-8M7C-8M39-RV4X...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: kots, harbor-fips, dive, podman, karpenter-fips, crossplane, nats, knative-operator-fips, nsc, knative-serving-fips, pulumi-language-yaml, aws-load-balancer-controller-fips, aactl, k9s-fips, zot, splunk-otel-collector-fips, gitea-fips, tekton-pipelines, flux, telegra...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: kots, harbor-fips, dive, podman, karpenter-fips, crossplane, nats, knative-operator-fips, nsc, knative-serving-fips, pulumi-language-yaml, aws-load-balancer-controller-fips, aactl, k9s-fips, zot, splunk-otel-collector-fips, gitea-fips, tekton-pipelines, flux, telegra...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-snapshotter-fips, fluxcd-kustomize-mutating-webhook-fips, nrdot-collector-k8s, jupyterhub-k8s-image-awaiter-fips, protoc-gen-go-grpc, nri-couchbase-fips, step-fips, pvc-autoresizer, knative-operator-fips, kubernetes-dashboard-auth,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, litestream, kots, kubernetes-csi-external-snapshotter-fips, stakater-reloader, harbor-fips, flux-image-automation-controller, crossplane-provider-aws-eks-fips, dive, kustomize-fips, grafana-beyla, eks-distro, neuvector, podman,...