Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: AWS loom — aws.amazon.com/security/security-bulletins/2026-124-aws Clear all filters
TI-2026-66043 CVE-2026-103958

Server-side request forgery in AWS loom

Priority LOW 36

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role…

CVSS 4.0HIGH 8.3 Network High privileges No interaction EPSS 0.0035 Published 2026-10-02 Fixed in 1.7.0 CWE-918
TI-2026-66042 CVE-2026-103957

Server-side request forgery in AWS loom

Priority LOW 36

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application…

CVSS 4.0HIGH 8.2 Network High privileges User interaction EPSS 0.004 Published 2026-10-02 Fixed in 1.7.0 CWE-201
TI-2026-66041 CVE-2026-103956

Missing authentication for critical function in Loom for AWS

Priority MEDIUM 54

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool se…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.02494 Published 2026-10-02 Fixed in 1.6.1 CWE-1188