Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed.
The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects in the Training Jobs S3 output location may have the ability to upload arbitrary artifacts which are executed the next time the Training Job is invoked.
A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges.
To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.
AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. This issue has been patched in version 4.0.3.3.
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces.
To mitigate, users should update to the latest version.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.8.8.
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-14764 is a medium-severity vulnerability in the Amazon S3 Encryption Client for Go involving the use of a broken or risky cryptographic algorithm due to missing cryptographic key commitment. This flaw allows a user with write access to an S3 bucket to introduce a new encrypted data key (EDK) that decrypts to different plaintext when the encrypted data key is stored in an instruction file rather than S3 metadata. The vulnerability does not impact confidentiality but can compromise data integrity by enabling unauthorized data manipulation. Exploitation requires network access, low privileges (write access), and no user interaction, with a CVSS score of 5.3. AWS has addressed this issue in version 4.0 or later of the S3 Encryption Client for Go. European organizations using vulnerable versions should upgrade promptly to prevent potential data integrity attacks, especially those relying on instruction file storage for encrypted data keys. Countries with significant AWS usage and cloud adoption, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.
Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.
To mitigate this issue, upgrade Amazon S3 Encryption Client for Java to version 4.0.0 or later.
CVE-2025-14762 is a medium-severity vulnerability in the AWS SDK for Ruby involving the use of a broken or risky cryptographic algorithm. The issue arises from missing cryptographic key commitment when encrypted data keys (EDKs) are stored in an "instruction file" rather than S3 metadata. This flaw allows a user with write access to an S3 bucket to introduce a malicious EDK that decrypts to different plaintext, potentially compromising data integrity. Exploitation requires network access, low privileges, and no user interaction, but has a high impact on integrity without affecting confidentiality or availability. AWS has addressed this vulnerability in SDK version 1.208.0 and later. European organizations using the AWS SDK for Ruby, especially those heavily reliant on S3 for encrypted data storage, should prioritize upgrading to mitigate risks. Countries with significant cloud adoption and AWS usage, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. The vulnerability does not appear to be exploited in the wild yet, but the risk of data tampering warrants prompt remediation.
CVE-2025-14761 is a medium-severity vulnerability in the AWS SDK for PHP involving the use of a broken or risky cryptographic algorithm. The issue arises from a missing cryptographic key commitment when encrypted data keys (EDKs) are stored in an instruction file rather than S3 metadata. This flaw allows a user with write access to an S3 bucket to introduce a malicious EDK that decrypts to different plaintext, potentially compromising data integrity. The vulnerability does not impact confidentiality or availability directly and requires low privileges but high attack complexity. No known exploits are currently reported in the wild. AWS has addressed this vulnerability in SDK version 3.368.0 and later. European organizations using AWS SDK for PHP with S3 encryption should prioritize upgrading to mitigate risks. Countries with significant AWS adoption and critical cloud infrastructure are more likely to be affected.
Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.
To mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later
Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.
To mitigate this issue, upgrade Amazon S3 Encryption Client for .NET to version 3.2.0 or later.
An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges.
We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.
CVE-2025-13524 is a medium severity vulnerability in AWS Wickr desktop applications (Windows, macOS, Linux) prior to version 6.62.13. It involves improper resource shutdown during call termination, which may allow a call participant to continue receiving audio input from another user after closing their call window under certain user actions. This issue does not affect confidentiality beyond audio exposure, nor does it impact integrity or availability. AWS has released version 6.62.13 to address this vulnerability.
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.
We recommend customers upgrade to the following versions: AWS JDBC Wrapper to v2.6.5, AWS Go Wrapper to 2025-10-17, AWS NodeJS Wrapper to v2.0.1, AWS Python Wrapper to v1.4.0 and AWS PGSQL ODBC driver to v1.0.1
An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots.
To mitigate this issue, users should upgrade to version 2025.09 or above.
Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. This issue only affects applications using IPv6.
We recommend upgrading to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.
