4,948 results · Feed
-
Medium max 7.2ALAS2-2026-3286 1 CVE
Moderate: python-tornado security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-35536: In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not ch…
first May 11, 2026 -
High max 9.2ALAS2-2026-3285 2 CVEs
Important: rclone security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41179: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to vers…
first May 11, 2026 -
High max 8.1ALAS2-2026-3284 1 CVE
Important: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41316: ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#re…
first May 11, 2026 -
Medium max 6.8ALAS2-2026-3283 1 CVE
Moderate: opencryptoki security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-23893: openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in pri…
first May 11, 2026 -
High max 8.8ALAS2-2026-3282 1 CVE
Important: PackageKit security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41651: PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit…
first May 11, 2026 -
High max 9.1ALAS2-2026-3281 2 CVEs
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-6100: Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryE…
first May 11, 2026 -
High max 9.1ALAS2-2026-3280 2 CVEs
Important: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-6100: Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryE…
first May 11, 2026 -
High max 9.3ALAS2023-2026-1688 1 CVE
Important: bouncycastle security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14813: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerabi…
first May 11, 2026 -
Medium max 5.9ALAS2023-2026-1680 2 CVEs
Moderate: krb5 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40356: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_conte…
first May 11, 2026 -
High max 7.5ALAS2023-2026-1679 1 CVE
Important: python3.13-lxml security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41066: lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (wit…
first May 11, 2026 -
High max 7.5ALAS2023-2026-1678 1 CVE
Important: python-lxml security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41066: lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (wit…
first May 11, 2026 -
High max 7.8ALAS2023-2026-1677 1 CVE
Important: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-5405: RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
first May 11, 2026 -
High max 5.1ALAS2023-2026-1676 1 CVE
Important: rust security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6654: Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips s…
first May 11, 2026 -
Low max 3.9ALAS2023-2026-1675 1 CVE
Low: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-31648: Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversa…
first May 11, 2026 -
Low max 5.7ALAS2023-2026-1674 1 CVE
Low: python3.14 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-2297: The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not us…
first May 11, 2026 -
Medium max 9.1ALAS2023-2026-1673 9 CVEs
Moderate: tomcat10 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34500: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects…
first May 11, 2026 -
Medium max 9.1ALAS2023-2026-1672 9 CVEs
Moderate: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34500: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1671 10 CVEs
Moderate: runfinch-finch security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33748: BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insuffi…
first May 11, 2026 -
Medium max 5.1ALAS2023-2026-1670 1 CVE
Moderate: libpng security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34757: Use-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST in libpng before 1.6.57. Passing a pointer returned by the corresponding getter back into…
first May 11, 2026 -
Medium max 2.9ALAS2023-2026-1669 1 CVE
Moderate: xdg-desktop-portal security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40354: Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on …
first May 11, 2026 -
Medium max 4.8ALAS2023-2026-1668 2 CVEs
Moderate: cups security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41079: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can s…
first May 11, 2026 -
High max 6.6ALAS2023-2026-1667 1 CVE
Important: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41411: Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolvi…
first May 11, 2026 -
High max 5.3ALAS2023-2026-1666 2 CVEs
Important: python3.12-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6357: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules name…
first May 11, 2026 -
High max 5.3ALAS2023-2026-1665 2 CVEs
Important: python3.11-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6357: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules name…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1663 1 CVE
Moderate: policycoreutils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-56005: An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1661 8 CVEs
Moderate: runc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1660 8 CVEs
Moderate: oci-add-hooks security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first May 11, 2026 -
Medium max 6.8ALAS2023-2026-1659 2 CVEs
Moderate: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-39882: OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response …
first May 11, 2026 -
High max 9.2ALAS2023-2026-1658 2 CVEs
Important: rclone security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41179: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to v…
first May 11, 2026 -
Medium max 5.5ALAS2023-2026-1656 1 CVE
Moderate: libXpm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4367: As per upstream advisory: libXpm Out-of-bounds read in xpmNextWord()
first May 11, 2026 -
Medium max 7.4ALAS2023-2026-1655 1 CVE
Moderate: mount-s3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4428: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which all…
first May 11, 2026 -
High max 5.3ALAS2023-2026-1654 1 CVE
Important: python3.13-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6357: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules name…
first May 11, 2026 -
High max 5.3ALAS2023-2026-1653 1 CVE
Important: python3.14-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6357: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules name…
first May 11, 2026 -
High max 9.8ALAS2023-2026-1652 29 CVEs
Important: firefox security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7323: Memory safety bugs present in Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0 and Thunderbird 150.0.0. Some of these bugs showed evidenc…
first May 11, 2026 -
High max 9.2ALAS2023-2026-1648 2 CVEs
Important: nodejs22 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27135: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming…
first May 11, 2026 -
High max 7.5ALAS2023-2026-1647 1 CVE
Important: nodejs24 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27135: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1645 8 CVEs
Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first May 11, 2026 -
Medium max 6.9ALAS2023-2026-1644 2 CVEs
Moderate: openvpn security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40215: In a race condition an old TLS session could still try to send a packet but also get replaced by a new session. In this case, the buffer of the new ses…
first May 11, 2026 -
Medium max 4.2ALAS2023-2026-1643 1 CVE
Moderate: freerdp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40254: FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/…
first May 11, 2026 -
Medium max 8.6ALAS2023-2026-1642 1 CVE
Moderate: editorconfig security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40489: editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a sta…
first May 11, 2026