Read this article Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Tag: Vulnerability
CVE-2026-116635 – Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper…
CVE-2026-120497 – Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Bulletin ID: 2026-163-AWS Publication Date: 11/02/2026 11:00 AM PST Description: aidlc-traceability is an open source command-line tool, formerly…
CVE-2026-119085 – Template injection in the publishing component of Virtual Engineering Workbench
Bulletin ID: 2026-162-AWS Publication Date: 11/02/2026 09:30 AM PST Description: Virtual Engineering Workbench (VEW) is an open-source platform where…
CVE-2026-119301 – Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Bulletin ID: 2026-161-AWS Publication Date: 11/02/2026 08:30 AM PST Description: We are aware of CVE-2026-119301 in the Apache Iceberg write component,…
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The…
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday,…
SMS of Death: Android Zero-Click DoS Vulnerability
A critical zero-click vulnerability in Android’s messaging framework allows attackers to crash phone services and block emergency calls by sending a…
POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability
A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary…
AI Vulnerability Finding
A comment : 3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another…
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released…
Ivanti patches two more Connect Secure zero-days chained in attacks
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at…
Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning
Fresh probes targeting CVE-2026-102764 have raised concerns that attacks against BeyondTrust Remote Support could spread beyond targeted espionage.…
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.
TightVNC Pre-Auth RCE Vulnerability Lets Hackers Execute Code on Windows PCs, PoC Released
A TightVNC Viewer vulnerability can let attackers execute code on Windows PCs before a password prompt appears. Research credited to SeongJoon Cho of SSD…
Critical Linux Kernel Vulnerability Could Allow Hackers to Gain Remote Root Access
A critical security vulnerability in the Linux kernel could allow attackers to remotely take control of vulnerable servers and execute commands with root…
Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.
Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down…
HTTP2Shell: The Brotli Vulnerability That Extends Beyond Node.js
The key point: CVE-2026-111497 now increasingly referred to as HTTP2Shell and initially reported as Node2Shell, is broader than a Node.js vulnerability.…
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited…