Companies/Amazon Web Services/CVEs

AAmazon Web Services CVEs

179 vulnerabilities mapped to Amazon Web Services’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-23

  CVE-2026-115845 Incomplete validation in the run_script Python sandbox in AWS MCP Server

  CVSS 6.4 mediumEPSS 0.31%

• 2026-10-23

  CVE-2026-115813 Server-side request forgery in the model download path in Amazon Web Services Multi Model Server

  CVSS 5.8 mediumEPSS 0.36%

• 2026-10-23

  CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server

  CVSS 9.8 criticalEPSS 0.53%

• 2026-10-22

  CVE-2026-115417 Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt

  CVSS 7.5 highEPSS 0.35%

• 2026-10-22

  CVE-2026-115419 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

  CVSS 8.1 highEPSS 0.43%

• 2026-10-22

  CVE-2026-115414 OS command injection in the Terraform hook in AWS SAM CLI

  CVSS 7.8 highEPSS 0.88%

• 2026-10-22

  CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processing

  CVSS 7.7 highEPSS 0.27%

• 2026-10-21

  CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

  CVSS 8.1 highEPSS 0.74%

• 2026-10-21

  CVE-2026-109619 RCE via stale global state

  CVSS 8.1 highEPSS 100.0%14 incidents

• 2026-10-21

  CVE-2026-109618 RCE via OOM corruption

  CVSS 9.8 criticalEPSS 100.0%15 incidents

• 2026-10-21

  CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509

  Not scoredEPSS 0.30%2 incidents

• 2026-10-20

  CVE-2026-112407 Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications

  CVSS 8.8 highEPSS 0.34%

• 2026-10-20

  CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew

  CVSS 9.9 criticalEPSS 0.41%

• 2026-10-16

  CVE-2026-102552 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver

  CVSS 5.9 mediumEPSS 0.23%

• 2026-10-16

  CVE-2026-102551 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling

  CVSS 7.7 highEPSS 0.27%

• 2026-10-16

  CVE-2026-109588 Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel

  CVSS 8.8 highEPSS 0.16%

• 2026-10-16

  CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel

  CVSS 8.8 highEPSS 0.14%

• 2026-10-15

  CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

  CVSS 9.9 criticalEPSS 0.37%

• 2026-10-15

  CVE-2026-99999 ipv4: validate checksum_start before completing checksum

  CVSS 9.3 criticalEPSS 0.79%3 incidents

• 2026-10-14

  CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

  CVSS 5.3 mediumEPSS 0.51%

• 2026-10-14

  CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

  CVSS 5.3 mediumEPSS 0.53%

• 2026-10-09

  CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

  CVSS 6.5 mediumEPSS 0.30%

• 2026-10-09

  CVE-2026-107783 Insertion of sensitive information into log file in AWS Tools for PowerShell

  CVSS 5.9 mediumEPSS 0.10%

• 2026-10-08

  CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib

  CVSS 5.5 mediumEPSS 0.14%

• 2026-10-08

  CVE-2026-107322 OS command injection in Amazon Agent Plugins for AWS databases-on-aws

  CVSS 7.8 highEPSS 0.13%

• 2026-10-08

  CVE-2026-107332 Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code

  CVSS 5.5 mediumEPSS 0.11%

• 2026-10-07

  CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling

  CVSS 7.7 highEPSS 0.20%

• 2026-10-06

  CVE-2026-106032 Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import

  CVSS 5.7 mediumEPSS 0.23%

• 2026-10-06

  CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

  CVSS 9.0 criticalEPSS 0.28%

• 2026-10-06

  CVE-2026-105811 Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS

  CVSS 6.5 mediumEPSS 0.33%

• 2026-10-02

  CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio

  CVSS 9.0 criticalEPSS 1.4%

• 2026-10-02

  CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

  CVSS 7.6 highEPSS 0.35%

• 2026-10-02

  CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

  CVSS 6.2 mediumEPSS 0.40%

• 2026-10-02

  CVE-2026-103956 Missing authentication for critical function in Loom for AWS

  CVSS 10.0 criticalEPSS 2.5%

• 2026-10-01

  CVE-2026-104002 Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

  CVSS 5.3 mediumEPSS 0.31%

• 2026-10-01

  CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python

  CVSS 7.5 highEPSS 0.44%

• 2026-10-01

  CVE-2026-97662 Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace

  CVSS 8.2 highEPSS 0.14%

• 2026-10-01

  CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap

  CVSS 6.5 mediumEPSS 0.43%

• 2026-09-29

  CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

  CVSS 7.8 highEPSS 0.14%

• 2026-09-24

  CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution

  CVSS 8.8 highEPSS 0.65%

• 2026-09-24

  CVE-2026-95985 Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces

  CVSS 8.8 highEPSS 0.14%

• 2026-09-22

  CVE-2026-94450 Potential denial of service when configured to send Retry packets in s2n-quic

  CVSS 7.5 highEPSS 1.9%

• 2026-09-22

  CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

  CVSS 8.1 highEPSS 0.32%

• 2026-09-17

  CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

  CVSS 8.1 highEPSS 0.38%

• 2026-09-16

  CVE-2026-86831 Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

  CVSS 8.7 highEPSS 0.64%

• 2026-09-14

  CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

  CVSS 7.2 highEPSS 0.69%

• 2026-09-11

  CVE-2026-89332 Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

  CVSS 5.5 mediumEPSS 0.18%

• 2026-09-11

  CVE-2026-89090 Denial of service in the event stream header decoder in AWS SDK for Go v2

  CVSS 5.9 mediumEPSS 0.30%

• 2026-09-11

  CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

  CVSS 5.9 mediumEPSS 0.46%

• 2026-09-11

  CVE-2026-89066 OS command injection in the task synthesis component in projen

  CVSS 7.8 highEPSS 0.23%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)