Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 04:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

154-74% vs 7-day avg of 597

2 critical, 44 high, 61 medium, 27 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	High	8.4	CVE-2026-115414	OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to... AWSaws-sam-cli	NVD		Oct 22 19:17 UTC
CVE-2026-115414OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to... Executive summary A flaw in the Terraform hook of AWS SAM CLI, a tool for building serverless applications, could let an attacker run arbitrary commands on the machine performing a build. The advisory rates it as important and says it requires attention. AWS recommends upgrading to version v1.166.2 or later, and reviewing that Terraform configuration and plan files come only from trusted sources. Technical summary The flaw is an OS command injection in the Terraform hook (sam build --hook-name terraform), where a Terraform resource address is interpolated into a generated Makefile recipe without fully neutralizing shell metacharacters. An attacker who can influence the Terraform configuration or plan file consumed by a build could execute commands as the build user on the build host. Impacted versions are stated as >=1.63.0, <=1.166.1, and the fixed version is v1.166.2. The advisory's workaround is to use only trusted Terraform configuration and plan files and audit third-party modules and shared repositories, and it says upgrading is the recommended remediation. No CVSS score, exploitation status, or specific detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from aws.amazon.com/security/security-bulletins/2026-145-aws Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects AWS aws-sam-cli NIST National Vulnerability DatabasePublished Oct 22, 2026 19:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee