2,507 results · Clear filters · Feed
-
High max 7.5ALAS2-2026-3232 1 CVE
Important: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-27135: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming da…
-
High max 9.8ALAS2-2026-3230 2 CVEs
Important: perl-XML-Parser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack w…
first Mar 30, 2026 -
High max 9.1ALAS2-2026-3229 4 CVEs
Important: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the H…
first Mar 30, 2026 -
High max 7.0ALAS2-2026-3228 3 CVEs
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior reje…
first Mar 30, 2026 -
High max 7.0ALAS2-2026-3227 3 CVEs
Important: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior reje…
first Mar 30, 2026 -
High max 8.1ALAS2023-2026-1586 5 CVEs
Important: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE encapsulation CVE-2026-28390: Possible NULL dereference when processing CMS KeyTransportRecipientInfo CVE-…
-
High max 8.7ALAS2023-2026-1585 2 CVEs
Important: libde265 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33165: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap writ…
-
High max 9.2ALAS2023-2026-1584 13 CVEs
Important: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34982: A modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader op…
-
High max 7.0ALAS2023-2026-1583 8 CVEs
Important: python3.9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…
-
High max 8.8ALAS2023-2026-1581 1 CVE
Important: javapackages-bootstrap security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d…
-
High max 7.5ALAS2023-2026-1578 8 CVEs
Important: nodejs24 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-26960: node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardli…
-
High max 7.5ALAS2023-2026-1577 6 CVEs
Important: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. …
-
High max 7.5ALAS2023-2026-1576 6 CVEs
Important: nodejs22 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. …
-
High max 9.1ALAS2023-2026-1573 4 CVEs
Important: soci-snapshotter security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
-
High max 9.1ALAS2023-2026-1572 4 CVEs
Important: amazon-cloudwatch-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
-
High max 7.5ALAS2023-2026-1570 3 CVEs
Important: dovecot security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27858: Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force m…
-
High max 9.2ALAS2023-2026-1569 2 CVEs
Important: squid security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33526: Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traf…
-
High max 7.5ALAS2023-2026-1564 5 CVEs
Important: amazon-efs-utils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4428: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which all…
-
High max 7.6ALAS2023-2026-1563 2 CVEs
Important: libpng security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33636: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions…
-
High max 8.2ALAS2023-2026-1560 2 CVEs
Important: corosync security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-35092: A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker …
-
High max 7.4ALAS2023-2026-1559 1 CVE
Important: sudo security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-35535: In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a …
-
High max 7.0ALAS2023-2026-1558 1 CVE
Important: python3.11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…
-
High max 7.0ALAS2023-2026-1557 1 CVE
Important: python3.12 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…
-
High max 7.0ALAS2023-2026-1556 1 CVE
Important: python3.14 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…
-
High max 7.0ALAS2023-2026-1555 1 CVE
Important: python3.13 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…
-
High max 10.0ALAS2023-2026-1554 39 CVEs
Important: firefox security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4721: Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed e…
-
High max 9.1ALAS2023-2026-1552 4 CVEs
Important: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
-
High max 9.1ALAS2023-2026-1551 1 CVE
Important: credentials-fetcher security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
-
High max 7.5ALAS2023-2026-1549 9 CVEs
Important: freerdp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33995: double free in kerberos_AcceptSecurityContext and kerberos_IntitalizeSecurityContextA NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA…
-
High max 9.1ALAS2023-2026-1548 1 CVE
Important: runfinch-finch security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
-
High max 7.8ALAS2023-2026-1547 1 CVE
Important: libtiff security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4775: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile functio…
-
High max 8.8ALAS2023-2026-1545 1 CVE
Important: plexus-utils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d…
-
High max 7.5ALAS2023-2026-1542 1 CVE
Important: nghttp2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27135: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming…
-
High max 8.2ALAS2023-2026-1540 6 CVEs
Important: nginx security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or…
-
High max 9.8ALAS2023-2026-1536 2 CVEs
Important: perl-XML-Parser security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stac…
first Mar 30, 2026 -
High max 9.1ALAS2023-2026-1535 4 CVEs
Important: nerdctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
first Mar 30, 2026 -
High max 9.1ALAS2023-2026-1534 4 CVEs
Important: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
first Mar 30, 2026 -
High max 7.8ALAS2-2026-3237 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-23066: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue
-
High max 7.5ALAS2023-2026-1533 1 CVE
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1519: If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only…
first Mar 30, 2026 -
High max 7.5ALAS2023-2026-1532 5 CVEs
Important: ecs-service-connect-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-26330: Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase li…
first Mar 30, 2026