CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

CVE-2026-18654

This CVE (CVE-2026-18654) affects the EMR SSH helper commands in the Amazon AWS CLI. The issue is “Key exchange without entity authentication,” enabling potential MITM attackers to intercept SSH sessions and file transfers when connecting to an EMR cluster endpoint. Affected products are AWS CLI ...

CVE-2026-18654

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

JLSEC-2026-1157 nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

fast-uri vulnerable to host confusion via backslash authority introducer

Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \, /, or / as the authority introducer in place of //, after an optional scheme is parsed with no authority: the sequence and everything after it fold into the path. Node's native...

GHSA-7P8R-X3MC-P8W7 fast-uri vulnerable to host confusion via backslash authority introducer

Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \, /, or / as the authority introducer in place of //, after an optional scheme is parsed with no authority: the sequence and everything after it fold into the path. Node's native...

EUVD-2026-51553

fast-uri vulnerable to host confusion via backslash authority introducer...

Improper Check for Unusual or Exceptional Conditions

Overview socket.io-parser is a socket.io protocol parser Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via attachment handling. An attacker can cause the server to exhaust memory resources by sending specially crafted packets that make th...

JLSEC-2026-1124

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement JWT and exposed via monitoring...

CVE-2026-18655 Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...

EUVD-2026-52406

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...

CVE-2026-18655

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...

CVE-2026-18655 Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...

CVE-2026-18655

CVE-2026-18655 affects awslabs.amazon-mq-mcp-server (MCP) prior to 2.0.24. The issue is an improper restriction of endpoints in the RabbitMQ broker connection tools, allowing a remote unauthenticated actor (via prompt injection) to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access ...

CVE-2026-61372

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue...

CVE-2026-61372

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue...

K000162734: Apache HTTP Server vulnerability CVE-2026-44186

Security Advisory Description Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in the modproxyftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version...

Allocation of Resources Without Limits or Throttling

Overview brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the expand, expand, combine, and expandSequence functions, which bound the accumulator where results are combined but not...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the HttpTransferCache used for server-side rendering, which builds the transfer-cache key by joining repeated HttpParams values with commas so that distinct parameter shapes produce the...

CVE-2026-61372 Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue...