4,948 results · Feed
-
High max 7.5ALAS2023-2026-1542 1 CVE
Important: nghttp2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27135: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming…
-
Medium max 7.5ALAS2023-2026-1541 3 CVEs
Moderate: runc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attri…
-
High max 8.2ALAS2023-2026-1540 6 CVEs
Important: nginx security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32647: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or…
-
Medium max 5.3ALAS2023-2026-1539 2 CVEs
Moderate: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-28422: Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a sta…
-
Medium max 7.5ALAS2023-2026-1538 1 CVE
Moderate: python-pyasn1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-30922: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontro…
-
Medium max 8.5ALAS2023-2026-1537 1 CVE
Moderate: tigervnc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34352: In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, bec…
-
High max 9.8ALAS2023-2026-1536 2 CVEs
Important: perl-XML-Parser security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stac…
first Mar 30, 2026 -
High max 9.1ALAS2023-2026-1535 4 CVEs
Important: nerdctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
first Mar 30, 2026 -
High max 9.1ALAS2023-2026-1534 4 CVEs
Important: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of th…
first Mar 30, 2026 -
High max 7.8ALAS2-2026-3237 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-23066: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue
-
High max 7.5ALAS2023-2026-1533 1 CVE
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1519: If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only…
first Mar 30, 2026 -
High max 7.5ALAS2023-2026-1532 5 CVEs
Important: ecs-service-connect-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-26330: Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase li…
first Mar 30, 2026 -
Low max 2.0ALAS2023-2026-1531 1 CVE
Low: python3.11-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1703: When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal…
first Mar 30, 2026 -
Low max 2.0ALAS2023-2026-1530 1 CVE
Low: python3.12-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1703: When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal…
first Mar 30, 2026 -
Medium max 5.3ALAS2023-2026-1529 1 CVE
Moderate: gnutls security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14831: A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via s…
first Mar 30, 2026 -
High max 8.7ALAS2023-2026-1528 4 CVEs
Important: python3.13-tornado security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-31958: Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in …
first Mar 30, 2026 -
Medium max 7.1ALAS2023-2026-1527 2 CVEs
Moderate: rust-cargo-c security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-25727: time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 28…
first Mar 30, 2026 -
High max 7.5ALAS2023-2026-1526 6 CVEs
Important: nodejs24 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-2581: This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when inter…
first Mar 30, 2026 -
High max 7.5ALAS2023-2026-1525 5 CVEs
Important: nodejs22 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-2229: ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the …
first Mar 30, 2026 -
High max 7.5ALAS2023-2026-1524 5 CVEs
Important: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-2229: ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the …
first Mar 30, 2026 -
Low max 6.8ALAS2023-2026-1523 1 CVE
Low: rust-below security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-25727: time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 28…
first Mar 30, 2026 -
Low max 6.5ALAS2023-2026-1522 1 CVE
Low: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-2673: Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration inclu…
first Mar 30, 2026 -
High max 7.8ALAS2023-2026-1521 2 CVEs
Important: gstreamer1-plugins-bad-free security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3082: GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co…
first Mar 30, 2026 -
Medium max 6.5ALAS2023-2026-1520 7 CVEs
Moderate: freerdp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-31897: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar wh…
first Mar 30, 2026 -
Medium max 7.5ALAS2023-2026-1519 1 CVE
Moderate: python-jwt security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32597: A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 SS4.1.11. Wh…
first Mar 30, 2026 -
Medium max 4.0ALAS2023-2026-1518 3 CVEs
Moderate: firefox security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32778: A flaw was found in libexpat. This vulnerability allows an attacker to trigger a NULL pointer dereference in the `setContext` function. This occurs whe…
first Mar 30, 2026 -
High max 9.1ALAS2023-2026-1517 1 CVE
Important: perl-YAML-Syck security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4177: YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emit…
first Mar 30, 2026 -
Medium max 7.5ALAS2023-2026-1513 3 CVEs
Moderate: golist security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attri…
first Mar 30, 2026 -
High max 9.3ALAS2023-2026-1512 14 CVEs
Important: freerdp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-31806: A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The `gdi_surface_bits()` function, which processes `SURFACE_BI…
first Mar 30, 2026 -
Medium max 5.3ALAS2023-2026-1511 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32636: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method c…
first Mar 30, 2026 -
High max 7.5ALAS2023-2026-1510 4 CVEs
Important: mount-s3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3338: Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects …
first Mar 30, 2026 -
Low max 3.3ALAS2023-2026-1509 1 CVE
Low: libheif security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3949: A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.…
first Mar 30, 2026 -
High max 5.1ALAS2023-2026-1508 1 CVE
Important: giflib security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23868: Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions need…
first Mar 30, 2026 -
Medium max 7.5ALAS2023-2026-1507 6 CVEs
Moderate: runfinch-finch security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attri…
first Mar 30, 2026 -
High max 7.5ALAS2023-2026-1506 2 CVEs
Important: dotnet9.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-26130: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-26127: Ou…
first Mar 30, 2026 -
High max 7.5ALAS2023-2026-1505 1 CVE
Important: dotnet8.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-26130: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
first Mar 30, 2026 -
High max 7.8ALAS2023-2026-1504 1 CVE
Important: gstreamer1-plugins-base security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-2921: An integer overflow in the RIFF parser that can cause crashes for certain input files.
first Mar 30, 2026 -
High max 8.8ALAS2023-2026-1503 2 CVEs
Important: gstreamer1-plugins-good security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3085: Heap-based buffer overflow and out-of-bounds write in the RTP QDM2 depayloader. CVE-2026-3083: Heap-based buffer overflow and out-of-bounds write in the…
first Mar 30, 2026 -
High max 8.7ALAS2023-2026-1502 1 CVE
Important: python-tornado security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-31958: Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in …
first Mar 30, 2026 -
Medium max 7.5ALAS2023-2026-1501 3 CVEs
Moderate: credentials-fetcher security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attri…
first Mar 30, 2026