Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

4,948 results · Feed

High max 7.0

ALAS2-2026-3227 3 CVEs

Important: python security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior reje…

Apr 13, 2026
first Mar 30, 2026
High max 8.1

ALAS2023-2026-1586 5 CVEs

Important: openssl security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE encapsulation CVE-2026-28390: Possible NULL dereference when processing CMS KeyTransportRecipientInfo CVE-…

Apr 13, 2026
High max 8.7

ALAS2023-2026-1585 2 CVEs

Important: libde265 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33165: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap writ…

Apr 13, 2026
High max 9.2

ALAS2023-2026-1584 13 CVEs

Important: vim security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34982: A modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader op…

Apr 13, 2026
High max 7.0

ALAS2023-2026-1583 8 CVEs

Important: python3.9 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…

Apr 13, 2026
High max 8.8

ALAS2023-2026-1581 1 CVE

Important: javapackages-bootstrap security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d…

Apr 13, 2026
Low max 5.6

ALAS2023-2026-1580 4 CVEs

Low: tracker-miners security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1767: A flaw was found in the GNOME localsearch MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulne…

Apr 13, 2026
Medium max 5.1

ALAS2023-2026-1579 1 CVE

Moderate: gstreamer1-plugins-good security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1940: An out-of-bounds read in the WAV parser that can cause crashes for certain input files.

Apr 13, 2026
High max 7.5

ALAS2023-2026-1578 8 CVEs

Important: nodejs24 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-26960: node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardli…

Apr 13, 2026
High max 7.5

ALAS2023-2026-1577 6 CVEs

Important: nodejs20 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. …

Apr 13, 2026
High max 7.5

ALAS2023-2026-1576 6 CVEs

Important: nodejs22 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. …

Apr 13, 2026
Medium max 7.5

ALAS2023-2026-1575 3 CVEs

Moderate: oci-add-hooks security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attri…

Apr 13, 2026
Medium max 7.5

ALAS2023-2026-1574 3 CVEs

Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attri…

Apr 13, 2026
High max 9.1

ALAS2023-2026-1573 4 CVEs

Important: soci-snapshotter security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…

Apr 13, 2026
High max 9.1

ALAS2023-2026-1572 4 CVEs

Important: amazon-cloudwatch-agent security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…

Apr 13, 2026
High max 7.5

ALAS2023-2026-1570 3 CVEs

Important: dovecot security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27858: Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force m…

Apr 13, 2026
High max 9.2

ALAS2023-2026-1569 2 CVEs

Important: squid security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33526: Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traf…

Apr 13, 2026
Medium max 7.1

ALAS2023-2026-1568 3 CVEs

Moderate: rust security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33056: tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir functi…

Apr 13, 2026
Medium max 5.1

ALAS2023-2026-1567 2 CVEs

Moderate: rust-below security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33056: tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir functi…

Apr 13, 2026
Medium max 5.1

ALAS2023-2026-1566 2 CVEs

Moderate: rust-cargo-c security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33056: tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir functi…

Apr 13, 2026
Medium max 5.1

ALAS2023-2026-1565 2 CVEs

Moderate: clamav1.5 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33056: tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir functi…

Apr 13, 2026
High max 7.5

ALAS2023-2026-1564 5 CVEs

Important: amazon-efs-utils security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4428: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which all…

Apr 13, 2026
High max 7.6

ALAS2023-2026-1563 2 CVEs

Important: libpng security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33636: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions…

Apr 13, 2026
Medium max 6.8

ALAS2023-2026-1562 1 CVE

Moderate: mod_security_crs security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33691: Whitespace padding in filenames bypasses file upload extension checks NOTE: https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w…

Apr 13, 2026
Medium max 8.4

ALAS2023-2026-1561 1 CVE

Moderate: openexr security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34544: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From v…

Apr 13, 2026
High max 8.2

ALAS2023-2026-1560 2 CVEs

Important: corosync security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-35092: A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker …

Apr 13, 2026
High max 7.4

ALAS2023-2026-1559 1 CVE

Important: sudo security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-35535: In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a …

Apr 13, 2026
High max 7.0

ALAS2023-2026-1558 1 CVE

Important: python3.11 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…

Apr 13, 2026
High max 7.0

ALAS2023-2026-1557 1 CVE

Important: python3.12 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…

Apr 13, 2026
High max 7.0

ALAS2023-2026-1556 1 CVE

Important: python3.14 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…

Apr 13, 2026
High max 7.0

ALAS2023-2026-1555 1 CVE

Important: python3.13 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior r…

Apr 13, 2026
High max 10.0

ALAS2023-2026-1554 39 CVEs

Important: firefox security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4721: Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed e…

Apr 13, 2026
High max 9.1

ALAS2023-2026-1552 4 CVEs

Important: ecs-init security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…

Apr 13, 2026
High max 9.1

ALAS2023-2026-1551 1 CVE

Important: credentials-fetcher security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…

Apr 13, 2026
Medium max 5.1

ALAS2023-2026-1550 2 CVEs

Moderate: ImageMagick security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33536: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, due to an incorrect ret…

Apr 13, 2026
High max 7.5

ALAS2023-2026-1549 9 CVEs

Important: freerdp security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33995: double free in kerberos_AcceptSecurityContext and kerberos_IntitalizeSecurityContextA NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA…

Apr 13, 2026
High max 9.1

ALAS2023-2026-1548 1 CVE

Important: runfinch-finch security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…

Apr 13, 2026
High max 7.8

ALAS2023-2026-1547 1 CVE

Important: libtiff security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4775: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile functio…

Apr 13, 2026
Medium max 5.5

ALAS2023-2026-1546 1 CVE

Moderate: polkit security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4897: A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid…

Apr 13, 2026
High max 8.8

ALAS2023-2026-1545 1 CVE

Important: plexus-utils security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d…

Apr 13, 2026