AWS Security Bulletins سه‌شنبه ۱۲ آبان ۱۴۰۵ · ۰۱:۱۳

CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been ena…

Vulnerabilities & Zero-Day Cloud Computing

Read the full article at AWS Security Bulletins Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

AWS Security Bulletins سه‌شنبه ۱۲ آبان ۱۴۰۵ · ۰۱:۱۰

CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS

Read this article Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Vulnerabilities & Zero-Day Cloud Computing

Source

Akamai Security Research سه‌شنبه ۱۲ آبان ۱۴۰۵ · ۰۰:۳۰

CVE-2026-98432: A Remote Use-After-Free in the Linux Kernel's TCP Stack

Learn about CVE-2026-98432, a critical remote use-after-free flaw in the Linux kernel TCP stack, its root exploit risks, affected versions, and mitigation steps.

Vulnerabilities & Zero-Day Networking & Internet Operating Systems

Source

AWS Security Bulletins دوشنبه ۱۱ آبان ۱۴۰۵ · ۲۲:۴۹

CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Bulletin ID: 2026-163-AWS Publication Date: 11/02/2026 11:00 AM PST Description: aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-workflows repository, that generates traceability-matrix reports from a project's AI-DLC artifact files. We identified CVE-2026-120497, where stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI could al…

Vulnerabilities & Zero-Day Cloud Computing Open Source

Source

Censys Research دوشنبه ۱۱ آبان ۱۴۰۵ · ۲۱:۳۳

Thoughts on Vulnerability Response in the Era of the Vulnpocalypse and PHP2Shell

There is no shortage of security vulnerabilities. Threat actors have never needed sophisticated exploits to breach organizations; they can and do use simple methods of initial access. They don’t even need a CVE: stolen credentials and good old-fashioned social engineering are still painfully effective. So when various AI products are marketed with doomsday warnings that […] The post Thoughts on Vulnerability Response…

Vulnerabilities & Zero-Day Data Breach

Source