Monthly
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.