Companies/Amazon Web Services/CVEs

AAmazon Web Services CVEs

179 vulnerabilities mapped to Amazon Web Services’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-09-11

  CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen

  CVSS 7.1 highEPSS 0.19%

• 2026-09-10

  CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

  CVSS 9.9 criticalEPSS 0.66%

• 2026-09-10

  CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library

  CVSS 9.1 criticalEPSS 0.54%

• 2026-09-10

  CVE-2026-87913 Missing S3 bucket ownership verification in the AWS Security Agent MCP server

  CVSS 5.9 mediumEPSS 0.44%

• 2026-09-10

  CVE-2026-87912 Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

  CVSS 5.9 mediumEPSS 0.44%

• 2026-09-09

  CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

  CVSS 9.6 criticalEPSS 1.7%

• 2026-09-09

  CVE-2026-85788 Incomplete list of disallowed inputs in awslabs mysql-mcp-server

  CVSS 5.5 mediumEPSS 0.18%

• 2026-09-08

  CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

  CVSS 8.7 highEPSS 0.54%

• 2026-09-04

  CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

  CVSS 6.5 mediumEPSS 0.34%

• 2026-09-04

  CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

  CVSS 8.7 highEPSS 0.44%

• 2026-09-03

  CVE-2026-85028 Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

  CVSS 7.8 highEPSS 0.17%

• 2026-09-03

  CVE-2026-85012 OS command injection in the Amazon CodeCatalyst blueprints SDK

  CVSS 8.0 highEPSS 2.3%

• 2026-09-01

  CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

  CVSS 7.2 highEPSS 0.80%

• 2026-08-27

  CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

  CVSS 7.1 highEPSS 0.20%

• 2026-08-21

  CVE-2026-77811 Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards

  CVSS 8.7 highEPSS 0.52%

• 2026-08-21

  CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

  CVSS 9.9 criticalEPSS 0.63%

• 2026-08-20

  CVE-2026-18420 RCE via Prototype Pollution in OpenSearch Dashboards

  CVSS 8.8 highEPSS 0.96%

• 2026-08-20

  CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

  CVSS 6.5 mediumEPSS 0.50%

• 2026-08-18

  CVE-2026-75897 Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards

  CVSS 7.5 highEPSS 0.72%

• 2026-08-13

  CVE-2026-18428 SQL Query Validation Bypass in OpenSearch Direct Query

  CVSS 8.8 highEPSS 1.00%

• 2026-08-12

  CVE-2026-19643 Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms

  CVSS 5.3 mediumEPSS 0.57%

• 2026-08-12

  CVE-2026-19642 Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp

  CVSS 5.9 mediumEPSS 0.50%

• 2026-08-12

  CVE-2026-18952 Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin

  CVSS 8.1 highEPSS 0.52%

• 2026-08-12

  CVE-2026-19311 Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

  CVSS 8.1 highEPSS 0.58%

• 2026-08-06

  CVE-2026-19111 Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

  CVSS 8.1 highEPSS 0.52%

• 2026-08-05

  CVE-2026-18954 Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

  CVSS 5.5 mediumEPSS 0.16%

• 2026-08-05

  CVE-2026-18953 Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server

  CVSS 8.6 highEPSS 0.18%

• 2026-08-04

  CVE-2026-18830 Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

  CVSS 8.1 highEPSS 0.51%

• 2026-08-03

  CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools

  CVSS 8.8 highEPSS 0.57%

• 2026-08-03

  CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

  CVSS 6.8 mediumEPSS 0.46%

• 2026-08-03

  CVE-2026-18655 Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-31

  CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

  CVSS 7.4 highEPSS 0.52%

• 2026-07-31

  CVE-2026-18481 Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

  CVSS 7.3 highEPSS 0.51%

• 2026-07-30

  CVE-2026-18140 Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

  CVSS 7.5 highEPSS 0.78%

• 2026-07-30

  CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

  CVSS 9.0 criticalEPSS 0.99%

• 2026-07-23

  CVE-2026-16796 Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

  CVSS 7.3 highEPSS 0.72%

• 2026-07-23

  CVE-2026-16756 Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

  CVSS 7.5 highEPSS 0.75%

• 2026-07-23

  CVE-2026-16584 AWS API MCP Server Security Policy Bypass via Startup Failure

  CVSS 7.0 highEPSS 0.23%

• 2026-07-21

  CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

  CVSS 6.5 mediumEPSS 0.25%

• 2026-07-21

  CVE-2026-15957 Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

  CVSS 7.5 highEPSS 0.75%

• 2026-07-17

  CVE-2026-15415 Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

  CVSS 5.5 mediumEPSS 0.35%

• 2026-07-17

  CVE-2026-12283 SQL injection in Amazon Athena Synapse connector

  CVSS 6.8 mediumEPSS 0.59%

• 2026-07-16

  CVE-2026-15737 Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

  CVSS 5.7 mediumEPSS 0.38%

• 2026-07-15

  CVE-2026-15895 OS command injection in jsii-diff in AWS jsii

  CVSS 7.8 highEPSS 1.1%

• 2026-07-14

  CVE-2026-15643 AWS HealthLake MCP Server SSRF via Pagination URL

  CVSS 7.3 highEPSS 0.39%

• 2026-07-07

  CVE-2026-14904 RES Auth.GetUserPrivateKey Arbitrary File Read

  CVSS 6.5 mediumEPSS 0.57%

• 2026-07-06

  CVE-2026-14471 Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

  CVSS 8.1 highEPSS 0.58%

• 2026-07-01

  CVE-2026-14265 RCE via Deserialization in AWS Advanced JDBC Wrapper

  CVSS 7.5 highEPSS 0.73%

• 2026-07-01

  CVE-2026-13760 OS Command Injection in aws-cdk-lib Docker Bundling

  CVSS 7.3 highEPSS 1.2%

• 2026-07-01

  CVE-2026-13769 Overly permissive File Permissions in AWS CLI

  CVSS 5.5 mediumEPSS 0.17%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)