CVE-2026-82856 - @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition ope

CVE-2026-81849 - Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in ama

CVE-2026-54330 - Ceph is an open-source distributed storage platform providing object, block, and file storage. In ve

CVE-2026-81838 - A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac)

CVE-2026-59300 - Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0

CVE-2026-19889 - GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of t

CVE-2026-48786 - Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, th

CVE-2026-80551 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDA

CVE-2026-80192 - @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7

CVE-2026-79787 - Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configurat

CVE-2026-79782 - rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes sche

CVE-2026-21752 - HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker una

CVE-2026-77810 - In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain ac

CVE-2026-75910 - Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Fede

CVE-2026-50173 - Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps

CVE-2026-74240 - A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and

CVE-2026-73658 - Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4

CVE-2026-63299 - An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level di

CVE-2026-19643 - An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some pla

CVE-2026-19642 - An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow

CVE-2026-10579 - A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged

CVE-2026-68872 - The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon prov

CVE-2026-19359 - A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this is

CVE-2026-11976 - The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) wa

CVE-2026-18954 - Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server be

CVE-2026-18953 - Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awsla

CVE-2026-70447 - Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Over

CVE-2026-17578 - Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reachin

CVE-2026-49004 - The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command

CVE-2026-18830 - Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remot

CVE-2026-58139 - The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any

CVE-2026-18655 - Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ

CVE-2026-18654 - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1

CVE-2026-18248 - @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and re

CVE-2026-67322 - GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The

CVE-2026-18536 - Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data:

CVE-2026-18481 - Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might a

CVE-2026-18245 - Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allo

CVE-2026-18140 - Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62

CVE-2026-58222 - A security flaw combining LDAP filter injection and improper authorization checks was found in Samba

CVE-2026-63239 - A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared m

CVE-2026-59931 - PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 th

CVE-2026-48035 - Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp

CVE-2026-16796 - Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent

CVE-2026-16756 - Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the de

CVE-2026-16584 - Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 migh

CVE-2026-47695 - CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game.

CVE-2026-15957 - Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers fr

CVE-2026-47394 - PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw /

CVE-2026-46412 - @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with Op

CVE-2026-47871 - VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation

CVE-2026-56741 - JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3

CVE-2026-50163 - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/u

CVE-2026-15415 - AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow en

CVE-2026-12283 - Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amaz