// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
CVE-2026-87912 and CVE-2026-87913 identify missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server.
-
CVE-2026-85788 - Issue with awslabs mysql-mcp-server
A CVE reports an issue in awslabs mysql-mcp-server, a tool for connecting MySQL databases with Model Context Protocol clients.
-
CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
A stored cross-site scripting issue in OpenSearch Dashboards involves a bypass of a Vega expression function.
-
CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
CVE-2026-85787 affects Amazon's PostgreSQL MCP server, allowing disallowed SQL inputs to modify data beyond read-only limits.
# Yesterday
-
CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform Hook
CVE-2026-115414 describes an OS command injection issue in AWS SAM CLI's Terraform hook, where resource addresses are interpolated into generated Makefile recipes.
-
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution or denial of service on affected workers.