CVE WatchOct 21, 2026

CVE-2026-112408

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 a

CVSS

8.1

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 21, 2026 · Last modified: Oct 21, 2026 · CWE-940

EPSS · 30d

Not enough EPSS history yet.

Technical description

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-89409—

—

———In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.9h CVE-2026-66279—

—

———In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.9h CVE-2026-1025525.9 MED

13.4%

——4Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.3d CVE-2026-1025517.7 HIG

18.6%

——6Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement. To remediate this issue, users should upgrade to version V4.4.2.3d CVE-2026-101897—

30.1%

——9Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.6d CVE-2026-877057.4 HIG

27.2%

——8Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.6d