CVE-2026-110812

Publié : 15 octobre 2026

Modifié : 15 octobre 2026

Score CVSS

9.9

CRITICAL

Description détaillée

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Références et Patchs

https://aws.amazon.com/security/security-bulletins/2026-136-aws/https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html

Dernières Vulnérabilités

CVE-2026-110378

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.

VOIR DÉTAILS

CVE-2026-110375

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.

VOIR DÉTAILS

CVE-2026-110374

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.

VOIR DÉTAILS