Two vulnerabilities were found in the open-source tool projen affecting versions before 0.101.37 and 0.103.0. CVE-2026-89065 is a relative path traversal vulnerability that may allow deletion of files outside the project directory. CVE-2026-89066 is an OS command injection vulnerability that could enable arbitrary command execution on developer workstations or CI runners. Fixes are available in versions 0.101.37 and 0.103.0 respectively. Users should upgrade and re-synthesize projects for CVE-2026-89066 to ensure safe task definitions.
CVE-2026-89049 is a server-side request forgery (SSRF) vulnerability in the AWS Systems Manager Agent's Session Manager port forwarding feature. An authenticated user with port-forwarding permission can bypass the remote destination denylist due to improper validation of equivalent address representations. This allows the user to reach link-local endpoints and potentially obtain the managed instance's temporary IAM role credentials, enabling actions with those permissions from outside the instance. The vulnerability affects all versions prior to 3.3.4851.0. AWS has released version 3.3.4851.0 to fix this issue. Until upgrading, it is recommended to restrict the use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping IAM permissions.
CVE-2026-87911 is a reported vulnerability with minimal publicly available information. No technical details, affected versions, or patch information have been provided. There is no evidence of exploitation in the wild at this time.
CVE-2026-87912 and CVE-2026-87913 refer to missing S3 bucket ownership verification vulnerabilities in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server. The vulnerabilities relate to improper validation of S3 bucket ownership, which could potentially lead to security issues. No specific affected versions or detailed technical information are provided. No known exploits are reported in the wild. No patch or remediation information is available at this time.
CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards involving a bypass of the Vega expression function. The vulnerability allows malicious input to be stored and later executed in users' browsers. No affected versions or patch information are provided. There is no evidence of exploitation in the wild.
CVE-2026-85788 is identified as a vulnerability related to the awslabs mysql-mcp-server. No detailed technical information, affected versions, or patch status is provided in the available data.
CVE-2026-85787 is a vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server versions prior to 1.1.7. It allows an unauthenticated actor to modify data beyond the intended read-only scope by injecting crafted SQL through content submitted by an authenticated user. The issue is fixed in version 1.1.7. Mitigation includes upgrading to version 1.1.7 or later and running the MCP server with a minimal-privilege Postgres role to enforce database-level access controls.
CVE-2026-111943 is a key-generation flaw in the external certificate authority eMudhra/emSign that made intermediate CA private keys recoverable. Three root certificates—AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3—were included in AWS trust bundles. This exposure allows soft-fail TLS clients to be vulnerable to man-in-the-middle attacks. AWS is actively removing these affected roots from their trust bundles. Customers using CloudFront custom origins or Application Load Balancer OIDC/JWT authentication should verify if their certificates chain to any of the affected roots and reissue certificates from a different CA before enforcement occurs.
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability in the Linux kernel's sched_ext scheduler caused CPU hotplug operations to hang when tasks on a dying CPU were managed by the BPF scheduler. The issue arose because tasks on the dying CPU's runqueue (rq) were not properly re-enqueued, causing the hotplug thread to wait indefinitely. This was fixed by ensuring tasks are re-enqueued on the local dequeue and that dispatch operations continue until the runqueue goes offline.
A vulnerability in the Linux kernel's rust_binder component was resolved that involved improper handling of node refcount updates when a thread exits. Specifically, when a thread exits via BINDER_THREAD_EXIT while holding a pending node refcount increment, the increment could be dropped due to no-op cancel functions. This caused desynchronization between the node's delivery and count states, potentially preventing the node from being freed properly. The fix implements cancellation logic to reschedule the refcount update on thread exit, ensuring proper delivery to userspace.
A vulnerability in the Linux kernel's IPv4 PMTU handling was resolved. The issue involved a null pointer dereference caused by a race condition when the nexthop group shrinks during a PMTU walk. This could lead to a kernel oops. Exploitation requires CAP_NET_ADMIN capability in the network namespace, which can be obtained by a local user in a new user and network namespace if unprivileged user namespaces are allowed.
A vulnerability in the Linux kernel IPv4 implementation was resolved by preventing an exception dump when a nexthop group shrinks during concurrent FIB dumps. The issue involved dereferencing a NULL pointer due to a race condition between fib_info_num_path() and fib_info_nhc() when nexthop groups are replaced with fewer paths.
A type confusion vulnerability in the Linux kernel's ati_remote2 driver was resolved by correcting device attribute handlers. The issue arose because attribute callbacks incorrectly treated usb_interface pointers as usb_device pointers, leading to invalid pointer usage. This was fixed by updating the callbacks to use the correct usb_interface pointers.
A memory leak vulnerability in the Linux kernel ALSA ctxfi component was fixed by ensuring allocated memory for DAO input mappers is properly freed when clearing them. The issue was caused by missing kfree() calls in the dao_clear_input() function, leading to memory not being released on each call.
A race condition in the Linux kernel's cpuset subsystem related to CPU hotplug operations could lead to a NULL pointer dereference. This occurs because the update order of cpu_active_mask and cpu_online_mask allows a race window where the top cpuset may have no active CPU. The issue was fixed by reintroducing a NULL check in guarantee_active_cpus() to prevent dereferencing a NULL pointer.
A vulnerability in the Linux kernel's CIPSO option handling was resolved. The cipso_v4_skbuff_delattr() function removed CIPSO bytes but failed to adjust cached offsets for subsequent options, causing consumers to access incorrect bytes. This could lead to improper interpretation of packet data and potential memory corruption when copying option data into fixed-size storage.
A vulnerability in the Linux kernel's vsock/virtio subsystem related to incorrect accounting of unread bytes in the read_skb() function has been resolved. The flaw caused the rx_bytes counter to underflow after partial stream receives, leading to incorrect socket status reporting and potentially hiding queued data until additional bytes arrived. This issue was identified during a manual source audit following a previous related vulnerability (CVE-2024-50169).
A vulnerability in the Linux kernel's mt7603 WiFi driver involved the use of an uninitialized global station WCID for frames without a station or vif, including those injected via a monitor interface. This led to a NULL pointer dereference causing kernel crashes. The issue was fixed by initializing the WCID before publishing it, preventing crashes during frame transmission.