QCS Security Advisory Desk
Security Advisory Desk.
Monitor network-edge vulnerabilities, known exploitation, affected products, mitigations, and vendor patch guidance without waiting for a weekly editorial cycle.
QCS pathSource-to-action path
- 01Official sourceMonitor vendors and trusted authorities.
- 02Verify contextCheck products, exposure, and evidence.
- 03Set prioritySeparate urgent action from useful reading.
- 04Act or learnPatch, mitigate, investigate, or prepare.
Live intelligence
See the items that can change today's patch or mitigation plan.
Priority combines source severity, known exploitation, remote attack conditions, recency, and network-edge relevance.
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
A security issue was found in OpenSearch Dashboards that could let a user with permission to change dashboards insert harmful code. This code would then run in other users' browsers, potentially exposing their accounts or data.
- Published
- 8 Sep 2026
- CVSS
- Not scored
- Verified
- 9 Sep 2026
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
A security issue was found in the Amazon awslabs postgres-mcp-server software before version 1.1.7. The software did not properly block certain malicious inputs in its SQL validation, which might allow someone without proper access to change data that should be read-only. Amazon fixed this in version 1.1.7 and recommends upgrading to protect your data.
- Published
- 4 Sep 2026
- CVSS
- Not scored
- Verified
- 5 Sep 2026
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-85656 - OS command injection in Amazon log4j-cve-2021-44228-hotpatch
Amazon identified a security flaw in a hotpatch tool for Java applications that could let a local attacker run harmful commands as the system's highest-privilege user. This tool was designed to patch a previous serious vulnerability without restarting Java programs but contained a new issue involving command injection triggered by unusual characters in process paths.
- Published
- 4 Sep 2026
- CVSS
- Not scored
- Verified
- 4 Sep 2026
unrated
Ubuntu / Priority 76
USN-8719-1: APR-util vulnerabilities
Several security flaws were found in the APR-util library used by Ubuntu. These issues could allow attackers to access sensitive information, crash applications, or even run malicious code remotely. Users of Ubuntu versions 18.04 LTS through 26.04 LTS should update their systems to fix these problems.
- Published
- 3 Sep 2026
- CVSS
- Not scored
- Verified
- 6 Sep 2026
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-84851- Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6
Amazon Ion-C is a library used by applications to read and write Amazon Ion data in C language. A vulnerability was found in versions before 1.1.6 where specially crafted Ion data can cause the software to crash by exhausting system resources, leading to a denial of service. This could be done remotely without authentication.
- Published
- 2 Sep 2026
- CVSS
- Not scored
- Verified
- 5 Sep 2026
unrated Exploitation reported
Cisco / Priority 76
Cisco Advance Notification for Publication of September 2, 2026, Security Advisories
On September 2, 2026, Cisco released security advisories for multiple products including Cisco IOS XR software, Cisco Nexus 9000 Series Switches, Cisco desk phones, and Cisco Secure Email. These advisories address critical vulnerabilities such as remote code execution and denial of service. Cisco strongly recommends customers upgrade to the indicated fixed software versions to protect their systems.
- Published
- 2 Sep 2026
- CVSS
- Not scored
- Verified
- 3 Sep 2026
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK
The Amazon SageMaker Python SDK used to protect data sent to cloud storage had a serious problem: it stored a secret security key in clear, readable form accessible through certain account functions. This flaw lets someone with permission to view pipeline details steal the key, fake data payloads, and run unauthorized code in another user's processing environment within the same AWS account.
- Published
- 1 Sep 2026
- CVSS
- Not scored
- Verified
- 1 Sep 2026
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination
A security flaw in the OpenSearch SQL Plugin lets someone with basic read or search permissions run harmful code on the server remotely. This happens when they send a specially crafted input to the plugin. AWS has released updates to fix this issue and recommends users upgrade their software or service immediately.
- Published
- 31 Aug 2026
- CVSS
- Not scored
- Verified
- 1 Sep 2026
unrated Exploitation reported
Ubuntu / Priority 76
USN-8620-4: Linux kernel (Intel IoTG) vulnerabilities
Several security vulnerabilities were found in the Linux kernel used by Ubuntu, including issues that could allow attackers to access sensitive information or escalate their privileges. One notable vulnerability in the NTFS file system could let attackers expose kernel memory by using a specially crafted malicious NTFS image. Other vulnerabilities involve certain AMD processors, where attackers with local access might leak sensitive data or gain higher-level access. This update addresses various flaws across many Linux kernel subsystems to enhance system security.
- Published
- 31 Jul 2026
- CVSS
- Not scored
- Verified
- 31 Jul 2026
unrated
Ubuntu / Priority 76
USN-8620-3: Linux kernel (Intel IoTG) vulnerabilities
This Ubuntu security advisory reports multiple vulnerabilities found in the Linux kernel, particularly for systems using Intel IoT and AMD processors, as well as various architectures and drivers. One notable issue in the NTFS file system code could let an attacker create a crafted file system image that reveals sensitive kernel memory when mounted. Other vulnerabilities affect AMD processors, potentially allowing local attackers to access sensitive information or escalate privileges. The update addresses numerous flaws across many subsystems and drivers, improving overall system security.
- Published
- 31 Jul 2026
- CVSS
- Not scored
- Verified
- 31 Jul 2026
unrated Exploitation reported
Ubuntu / Priority 76
USN-8620-2: Linux kernel (Azure FIPS) vulnerabilities
Ubuntu issued a security update for the Azure FIPS Linux kernel on Ubuntu 22.04 LTS. The update addresses many kernel flaws. Specifically described risks include disclosure of kernel memory through a malicious NTFS image, local disclosure of sensitive processor data on some AMD CPUs, and possible local privilege escalation on some AMD Zen 2 CPUs.
- Published
- 29 Jul 2026
- CVSS
- Not scored
- Verified
- 30 Jul 2026
unrated Exploitation reported
Ubuntu / Priority 76
USN-8620-1: Linux kernel vulnerabilities
Multiple security vulnerabilities were found in the Linux kernel used by Ubuntu, including problems with the NTFS file system and certain AMD processors that could expose sensitive information or allow attackers to gain higher privileges on the system. These issues affect many parts of the kernel and various drivers, potentially allowing attackers to compromise the system. Updates have been provided to address these problems.
- Published
- 28 Jul 2026
- CVSS
- Not scored
- Verified
- 30 Jul 2026