QCS Security Advisory Desk
Security Advisory Desk.
Monitor network-edge vulnerabilities, known exploitation, affected products, mitigations, and vendor patch guidance without waiting for a weekly editorial cycle.
QCS pathSource-to-action path
- 01Official sourceMonitor vendors and trusted authorities.
- 02Verify contextCheck products, exposure, and evidence.
- 03Set prioritySeparate urgent action from useful reading.
- 04Act or learnPatch, mitigate, investigate, or prepare.
Live intelligence
See the items that can change today's patch or mitigation plan.
Priority combines source severity, known exploitation, remote attack conditions, recency, and network-edge relevance.
unrated
Amazon Web Services / Priority 70
CVE-2026-92943 - Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
The AWS IoT Device SDK for Python had a security flaw where it failed to properly check if a server's security certificate matched the expected AWS IoT Core endpoint name. Because of this, attackers on the same network could pretend to be the AWS IoT server, eavesdrop on device data, or send fake messages to the device. This vulnerability affected popular connection methods and requires users to upgrade the SDK to fix the issue.
- Published
- 17 Sep 2026
- CVSS
- Not scored
- Verified
- 18 Sep 2026
unrated Exploitation reported
Amazon Web Services / Priority 70
CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
Amazon EKS had a security issue in its Network Policy Agent that could allow network policies to be bypassed across different Kubernetes namespaces. This happened because pod identifiers were created by joining pod names and namespaces using a hyphen. Since both pod names and namespaces can legally contain hyphens, this method could cause identifier confusion between pods in different namespaces. Updating to version 1.4.0 or later of the Network Policy Agent fixes this problem.
- Published
- 16 Sep 2026
- CVSS
- Not scored
- Verified
- 18 Sep 2026
unrated Exploitation reported
Ubuntu / Priority 70
USN-8761-1: Linux kernel (Azure) vulnerabilities
Multiple security flaws were found in the Linux kernel used on Ubuntu systems running in Microsoft Azure cloud environments. These flaws could allow attackers to compromise affected systems. An update is available that addresses these vulnerabilities across many different kernel components.
- Published
- 15 Sep 2026
- CVSS
- Not scored
- Verified
- 16 Sep 2026
unrated
Amazon Web Services / Priority 70
CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
Temporary Elevated Access Management (TEAM) is an open source tool from AWS that helps manage temporary higher-level permissions using AWS IAM Identity Center. A security issue was found where a user who is allowed to use the application could gain more temporary access rights than intended to certain AWS accounts. This could let them perform actions they should not be allowed to do. AWS released version 1.5.1 of TEAM to fix this problem and recommends upgrading. There are no workarounds available, so updating is necessary to protect your environment.
- Published
- 14 Sep 2026
- CVSS
- Not scored
- Verified
- 15 Sep 2026
unrated
Amazon Web Services / Priority 70
CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration
Kiro IDE, a developer tool that uses AI agents, had a security issue where a malicious code repository could change important workspace settings to send sensitive data outside before users approved the change. This could lead to private project information being leaked without consent.
- Published
- 11 Sep 2026
- CVSS
- Not scored
- Verified
- 14 Sep 2026
unrated Exploitation reported
Amazon Web Services / Priority 70
CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2
A problem in the AWS SDK for Go v2 can cause a program using it to crash if it receives a specially messed-up message. This happens because the program tries to read a part of the message called the EventStream header, but if the message contains an invalid type byte, the program will stop working unexpectedly.
- Published
- 11 Sep 2026
- CVSS
- Not scored
- Verified
- 14 Sep 2026
unrated Exploitation reported
Amazon Web Services / Priority 70
CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection
Projen is a tool that helps developers set up and manage software projects using code. Two serious security flaws were found in Projen that could let attackers delete files outside the project or run harmful commands on a developer's computer or automated testing systems. Updating Projen to fixed versions is necessary to prevent these risks.
- Published
- 11 Sep 2026
- CVSS
- Not scored
- Verified
- 14 Sep 2026
unrated
Google Cloud / Priority 70
GCP-2026-058
A security flaw was found in the Google Kubernetes Engine (GKE) Multi-Cloud APIs that manage clusters attached from AWS and Azure. Due to a missing project permission check, an attacker could register a cluster in another customer's project without authorization. This allowed them to create identity tokens and impersonate Kubernetes service accounts linked to that project, posing a serious security risk.
- Published
- 11 Sep 2026
- CVSS
- Not scored
- Verified
- 12 Sep 2026
unrated Exploitation reported
Google Cloud / Priority 70
GCP-2026-057
Google Cloud has identified multiple security vulnerabilities in Envoy Proxy, a key component used for managing network traffic in service mesh architectures. These vulnerabilities vary in severity from moderate to high and could potentially be exploited by attackers if not addressed. Users leveraging Google Cloud's service mesh solutions should consult the related Cloud Service Mesh security bulletin for detailed guidance on how to protect their environments.
- Published
- 11 Sep 2026
- CVSS
- Not scored
- Verified
- 12 Sep 2026
unrated
Amazon Web Services / Priority 70
CVE-2026-85012 - OS command injection in the Amazon CodeCatalyst blueprints SDK
Amazon CodeCatalyst blueprints are templates used to create software projects. A security problem was found in the open-source framework they use called @amazon-codecatalyst/blueprints.blueprint. In versions before 0.3.156, the software would run system commands containing unvalidated input, allowing someone who can commit code to run harmful commands in the environment that rebuilds projects. However, if you use the Amazon CodeCatalyst service directly, no action is needed because it runs safely with checks. Users should update to version 0.3.156 or later if they use the npm package.
- Published
- 9 Sep 2026
- CVSS
- Not scored
- Verified
- 11 Sep 2026
unrated
Amazon Web Services / Priority 70
CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin
A security issue was found in the OpenSearch Alerting plugin used by Amazon Web Services. This problem could let users who already have a certain alerting access permission read, change, or delete data they should not control by sending a specially crafted request. To fix this, users should update the OpenSearch Alerting plugin or Amazon OpenSearch Service to the latest versions that include the security patch.
- Published
- 9 Sep 2026
- CVSS
- Not scored
- Verified
- 14 Sep 2026
unrated
Amazon Web Services / Priority 70
CVE-2026-18830 - Issue with Amazon Bedrock AgentCore harness – Insufficient Input Validation
An input validation flaw was found in the Amazon Bedrock AgentCore harness's InvokeHarness API. This flaw lets authenticated users bypass normal model checks and directly activate certain configured tools, potentially leading to unauthorized tool execution. The risk depends on which tools are set up in each harness. AWS fixed this by adding checks on their servers to reject unsafe requests before they can trigger these tools.
- Published
- 9 Sep 2026
- CVSS
- Not scored
- Verified
- 14 Sep 2026