CVE-2026-31271

CVE-2026-31271 concerns megagao production_ssm v1.0, where the insert() function in UserController.java lacks authentication checks, enabling unauthenticated attackers to access the /user/insert endpoint and create super administrator accounts. This authorization bypass could lead to full system ...

OPENSUSE-SU-2026:10486-1 amazon-ssm-agent-3.3.4121.0-1.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4121.0-1.1 package on the GA media of openSUSE Tumbleweed...

Important: amazon-ssm-agent

Issue Overview: cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Affected Packages: amazon-ssm-agent Issue Correction: Run dnf update amazon-ssm-agent --releasever 2023.10.20260330 or d...

airduct (>=0.1.13 <=0.1.22), aprsd (>=1.6.0 <=3.4.4) +42 more potentially affected by CVE-2026-34531 via flask-httpauth (>=2.5.0 <=4.8.0)

flask-httpauth PYPI version =2.5.0, =0.1.13, =1.6.0, =1.0.5, =0.0.5, =0.5.0, =4.2.6, =1.0.0, =0.0.28, =0.0.0rc24, =1.0.2, =0.2.2, =3.2.0.0, =2.0.0, =0.1.8.1, =2.2.1 and more Source cves: CVE-2026-34531 Source advisory: OSV:GHSA-P44Q-VQPR-4XMG...

Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2026-3207 (ALAS-2026-3207)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.3883.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3207 advisory. cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected...

Important: amazon-ssm-agent

Issue Overview: cmd/go: bypass of flag sanitization can lead to arbitrary code execution CVE-2025-61731 cmd/go: unexpected code execution when invoking toolchain CVE-2025-68119 Affected Packages: amazon-ssm-agent Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this...

openSUSE 16 Security Update : amazon-ssm-agent (openSUSE-SU-2026:20351-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20351-1 advisory. - CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or signing request bsc1253611. Tenab...

Security update for amazon-ssm-agent (important)

openSUSE security update: security update for amazon-ssm-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20351-1 Rating: important References: bsc1253611 Cross-References: CVE-2025-47913 CVSS scores: CVE-2025-47913 SUSE : 7.5...

OPENSUSE-SU-2026:20351-1 Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: - CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or signing request bsc1253611...

CVE-2026-27661

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application leaks confidential information in metadata, and files such as information on contributors and email address, on SSM Server...

PT-2026-24226

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application leaks confidential information in metadata, and files such as information on contributors and email address, on SSM Server...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, flux-kustomize-controller, kyverno-notation-aws, kyverno-notation-aws-fips, helm-push, terraform-provider-pagerduty-fips, gitea, cerbos, pulumi-language-java, argo-workflows, crossplane-provider-aws-efs, reports-server,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, flux-kustomize-controller, kyverno-notation-aws, kyverno-notation-aws-fips, helm-push, terraform-provider-pagerduty-fips, gitea, cerbos, pulumi-language-java, argo-workflows, crossplane-provider-aws-efs, reports-server,...

CVE-2026-2864

A vulnerability has been found in fenghaha/megagao ssm-erp and productionssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched...

CVE-2026-2864 feng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversal

A vulnerability has been found in fenghaha/megagao ssm-erp and productionssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched...

CVE-2026-2864

A vulnerability has been found in fenghaha/megagao ssm-erp and productionssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched...

CVE-2026-2864 feng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversal

A vulnerability has been found in fenghaha/megagao ssm-erp and productionssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched...

CVE-2026-2864

CVE-2026-2864 affects feng_ha_ha/megagao ssm-erp and production_ssm up to a certain commit. The vulnerability lies in the function pictureDelete of PictureController.java, where manipulating the argument picName enables path traversal. The issue can be exploited remotely and the public exploit is...

CVE-2026-2863 feng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java deleteFile path traversal

A flaw has been found in fenghaha/megagao ssm-erp and productionssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. The impacted element is the function deleteFile of the file FileServiceImpl.java. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been...

CVE-2026-2863 feng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java deleteFile path traversal

A flaw has been found in fenghaha/megagao ssm-erp and productionssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. The impacted element is the function deleteFile of the file FileServiceImpl.java. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been...