Companies/Amazon Web Services/CVEs

AAmazon Web Services CVEs

19 matching vulnerabilities mapped to Amazon Web Services’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-23

  CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server

  CVSS 9.8 criticalEPSS 0.53%

• 2026-10-21

  CVE-2026-109618 RCE via OOM corruption

  CVSS 9.8 criticalEPSS 100.0%15 incidents

• 2026-10-20

  CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew

  CVSS 9.9 criticalEPSS 0.41%

• 2026-10-15

  CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

  CVSS 9.9 criticalEPSS 0.37%

• 2026-10-15

  CVE-2026-99999 ipv4: validate checksum_start before completing checksum

  CVSS 9.3 criticalEPSS 0.79%3 incidents

• 2026-10-06

  CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

  CVSS 9.0 criticalEPSS 0.28%

• 2026-10-02

  CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio

  CVSS 9.0 criticalEPSS 1.4%

• 2026-10-02

  CVE-2026-103956 Missing authentication for critical function in Loom for AWS

  CVSS 10.0 criticalEPSS 2.5%

• 2026-09-10

  CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

  CVSS 9.9 criticalEPSS 0.66%

• 2026-09-10

  CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library

  CVSS 9.1 criticalEPSS 0.54%

• 2026-09-09

  CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

  CVSS 9.6 criticalEPSS 1.7%

• 2026-08-21

  CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

  CVSS 9.9 criticalEPSS 0.63%

• 2026-07-30

  CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

  CVSS 9.0 criticalEPSS 0.99%

• 2026-06-29

  CVE-2026-13763 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF

  CVSS 9.8 criticalEPSS 0.68%

• 2026-06-29

  CVE-2026-13762 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF

  CVSS 9.8 criticalEPSS 0.63%

• 2026-06-08

  CVE-2026-11393 Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import

  CVSS 9.0 criticalEPSS 0.34%

• 2026-05-18

  CVE-2026-8838 Remote Code Execution via eval() Injection in amazon-redshift-python-driver

  CVSS 9.8 criticalEPSS 0.81%

• 2026-04-24

  CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel

  CVSS 9.8 criticalEPSS 0.25%

• 2025-01-29

  CVE-2025-0851 Path traversal issue in Deep Java Library

  CVSS 9.8 criticalEPSS 23.3%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)