CVE-2026-89090 is a denial of service vulnerability in the event stream header decoder of AWS SDK for Go v2 versions prior to 2026-03-23. An unauthenticated remote actor can send a crafted event stream response frame with an invalid header value type, causing the application process to panic and terminate. The issue is fixed in version 2026-03-23 and later.
CVE-2026-18061 is an XML External Entity (XXE) vulnerability in the AWS Advanced JDBC Wrapper's optional RemoteQueryCachePlugin. This plugin, when enabled with a shared cache, allows an attacker with write access to insert malicious XML into cached column values. When the application reads these cached results as XML, external entities are resolved, potentially exposing sensitive files accessible to the application process, including database and IAM role credentials. The vulnerability affects versions from 3.3.0 through 4.2.0 and is fixed in version 4.3.0. The plugin is not enabled by default. Mitigation includes disabling the plugin or restricting write access to the shared cache.
Two vulnerabilities were found in the open-source tool projen affecting versions before 0.101.37 and 0.103.0. CVE-2026-89065 is a relative path traversal vulnerability that may allow deletion of files outside the project directory. CVE-2026-89066 is an OS command injection vulnerability that could enable arbitrary command execution on developer workstations or CI runners. Fixes are available in versions 0.101.37 and 0.103.0 respectively. Users should upgrade and re-synthesize projects for CVE-2026-89066 to ensure safe task definitions.
CVE-2026-89049 is a server-side request forgery (SSRF) vulnerability in the AWS Systems Manager Agent's Session Manager port forwarding feature. An authenticated user with port-forwarding permission can bypass the remote destination denylist due to improper validation of equivalent address representations. This allows the user to reach link-local endpoints and potentially obtain the managed instance's temporary IAM role credentials, enabling actions with those permissions from outside the instance. The vulnerability affects all versions prior to 3.3.4851.0. AWS has released version 3.3.4851.0 to fix this issue. Until upgrading, it is recommended to restrict the use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping IAM permissions.
CVE-2026-87911 is a reported vulnerability with minimal publicly available information. No technical details, affected versions, or patch information have been provided. There is no evidence of exploitation in the wild at this time.
CVE-2026-87912 and CVE-2026-87913 refer to missing S3 bucket ownership verification vulnerabilities in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server. The vulnerabilities relate to improper validation of S3 bucket ownership, which could potentially lead to security issues. No specific affected versions or detailed technical information are provided. No known exploits are reported in the wild. No patch or remediation information is available at this time.
CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards involving a bypass of the Vega expression function. The vulnerability allows malicious input to be stored and later executed in users' browsers. No affected versions or patch information are provided. There is no evidence of exploitation in the wild.
CVE-2026-85788 is identified as a vulnerability related to the awslabs mysql-mcp-server. No detailed technical information, affected versions, or patch status is provided in the available data.
CVE-2026-85787 is a vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server versions prior to 1.1.7. It allows an unauthenticated actor to modify data beyond the intended read-only scope by injecting crafted SQL through content submitted by an authenticated user. The issue is fixed in version 1.1.7. Mitigation includes upgrading to version 1.1.7 or later and running the MCP server with a minimal-privilege Postgres role to enforce database-level access controls.
CVE-2026-111943 is a key-generation flaw in the external certificate authority eMudhra/emSign that made intermediate CA private keys recoverable. Three root certificates—AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3—were included in AWS trust bundles. This exposure allows soft-fail TLS clients to be vulnerable to man-in-the-middle attacks. AWS is actively removing these affected roots from their trust bundles. Customers using CloudFront custom origins or Application Load Balancer OIDC/JWT authentication should verify if their certificates chain to any of the affected roots and reissue certificates from a different CA before enforcement occurs.
CVE-2026-116004 is a cross-site scripting (XSS) vulnerability in the onyx-dot-app Onyx product, specifically affecting version 5.0.0. The vulnerability exists in an unknown function within the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The flaw allows remote attackers to execute XSS attacks. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. The CVSS 4.0 score rates this as a medium severity issue.
Red Hat has issued a security advisory for a bug fix and enhancement update to Red Hat Hardened Images RPMs, specifically including qt6 packages. The update addresses issues related to CVE-2026-105923 and CVE-2026-95620. No explicit details about the vulnerability or exploit methods are provided. The advisory lists updated qt6 RPM packages across multiple architectures.
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability in the Linux kernel's sched_ext scheduler caused CPU hotplug operations to hang when tasks on a dying CPU were managed by the BPF scheduler. The issue arose because tasks on the dying CPU's runqueue (rq) were not properly re-enqueued, causing the hotplug thread to wait indefinitely. This was fixed by ensuring tasks are re-enqueued on the local dequeue and that dispatch operations continue until the runqueue goes offline.
A vulnerability in the Linux kernel's rust_binder component was resolved that involved improper handling of node refcount updates when a thread exits. Specifically, when a thread exits via BINDER_THREAD_EXIT while holding a pending node refcount increment, the increment could be dropped due to no-op cancel functions. This caused desynchronization between the node's delivery and count states, potentially preventing the node from being freed properly. The fix implements cancellation logic to reschedule the refcount update on thread exit, ensuring proper delivery to userspace.
A vulnerability in the Linux kernel's IPv4 PMTU handling was resolved. The issue involved a null pointer dereference caused by a race condition when the nexthop group shrinks during a PMTU walk. This could lead to a kernel oops. Exploitation requires CAP_NET_ADMIN capability in the network namespace, which can be obtained by a local user in a new user and network namespace if unprivileged user namespaces are allowed.
A vulnerability in the Linux kernel IPv4 implementation was resolved by preventing an exception dump when a nexthop group shrinks during concurrent FIB dumps. The issue involved dereferencing a NULL pointer due to a race condition between fib_info_num_path() and fib_info_nhc() when nexthop groups are replaced with fewer paths.
A type confusion vulnerability in the Linux kernel's ati_remote2 driver was resolved by correcting device attribute handlers. The issue arose because attribute callbacks incorrectly treated usb_interface pointers as usb_device pointers, leading to invalid pointer usage. This was fixed by updating the callbacks to use the correct usb_interface pointers.
A memory leak vulnerability in the Linux kernel ALSA ctxfi component was fixed by ensuring allocated memory for DAO input mappers is properly freed when clearing them. The issue was caused by missing kfree() calls in the dao_clear_input() function, leading to memory not being released on each call.