CompaniesAmazon Web ServicesCVEs
Amazon Web Services CVEs
179 vulnerabilities mapped to Amazon Web Services’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-13762 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF
CVSS 9.8 criticalEPSS 0.63%
CVE-2026-12958 Arbitrary file write in Language Servers for AWS
CVSS 7.8 highEPSS 0.19%
CVE-2026-12957 Arbitrary Code Execution in Language Servers for AWS
CVSS 7.8 highEPSS 0.23%
CVE-2026-11931 Insecure Permissions on Authentication Token Cache File in Kiro IDE
CVSS 5.5 mediumEPSS 0.12%
CVE-2026-12043 Heap double-free in AWS Common Runtime aws-c-http
CVSS 8.8 highEPSS 0.35%
CVE-2026-10740 Excessive memory allocation in s2n-quic
CVSS 5.3 mediumEPSS 0.29%
CVE-2026-11417 OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
CVSS 7.3 highEPSS 0.99%
CVE-2026-11393 Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import
CVSS 9.0 criticalEPSS 0.34%
CVE-2026-11401 Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
CVSS 8.0 highEPSS 0.30%
CVE-2026-11400 Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
CVSS 8.0 highEPSS 0.50%
CVE-2026-10584 HTTPS Fallback to HTTP in Graph Explorer
CVSS 5.9 mediumEPSS 0.10%
CVE-2026-10591 Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
CVSS 8.8 highEPSS 0.83%
CVE-2026-9291 Insecure Deserialization in Amazon Braket SDK Job Results Processing
CVSS 7.1 highEPSS 0.38%
CVE-2026-9255 Tool Execution Without Authorization via Piped Stdin in Kiro CLI
CVSS 7.8 highEPSS 0.12%
CVE-2026-9133 Arbitrary file read in rabbitmq-aws plugin
CVSS 7.7 highEPSS 1.1%
CVE-2026-8838 Remote Code Execution via eval() Injection in amazon-redshift-python-driver
CVSS 9.8 criticalEPSS 0.81%
CVE-2026-7425 Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP
CVSS 6.5 mediumEPSS 0.23%
CVE-2026-7424 Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP
CVSS 8.1 highEPSS 0.22%
CVE-2026-7423 Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP
CVSS 5.3 mediumEPSS 0.22%
CVE-2026-7422 MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing
CVSS 6.5 mediumEPSS 0.18%
CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough
CVSS 5.9 mediumEPSS 0.53%
CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough
CVSS 5.9 mediumEPSS 0.25%
CVE-2026-6966 Signature Threshold Bypass in awslabs/tough Delegated Roles
CVSS 5.3 mediumEPSS 0.28%
CVE-2026-6912 Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel
CVSS 8.8 highEPSS 0.55%
CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel
CVSS 9.8 criticalEPSS 0.25%
CVE-2026-6550 Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python
CVSS 4.7 mediumEPSS 0.10%
CVE-2026-5747 Out-of-bounds Write in Firecracker virtio-pci Transport
CVSS 7.5 highEPSS 0.26%
CVE-2026-5709 AWS Research and Engineering Studio (RES) FileBrowser Command Injection
CVSS 8.8 highEPSS 1.1%
CVE-2026-5708 Improper Control of User-Modifiable Attributes in RES CreateSession API
CVSS 8.8 highEPSS 0.84%
CVE-2026-5429 Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme
CVSS 7.8 highEPSS 0.16%
CVE-2026-5190 AWS C Event Stream Streaming Decoder Stack Buffer Overflow
CVSS 7.5 highEPSS 0.41%
CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC
CVSS 7.4 highEPSS 0.26%
CVE-2026-4295 Arbitrary code execution via crafted project files in Kiro IDE
CVSS 7.8 highEPSS 0.22%
CVE-2026-4269 Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
CVSS 7.5 highEPSS 0.25%
CVE-2026-4270 AWS API MCP File Access Restriction Bypass
CVSS 5.5 mediumEPSS 0.13%
CVE-2026-3338 PKCS7_verify Signature Validation Bypass in AWS-LC
CVSS 7.5 highEPSS 0.81%
CVE-2026-3337 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC
CVSS 5.9 mediumEPSS 1.1%
CVE-2026-3336 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
CVSS 7.5 highEPSS 0.78%
CVE-2026-1778 TLS disabled by default in select aws/sagemaker-python-sdk configurations
CVSS 5.9 mediumEPSS 0.26%
CVE-2026-1777 Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk
CVSS 7.2 highEPSS 0.52%
CVE-2026-1386 Arbitrary Host File Overwrite via Symlink in Firecracker Jailer
CVSS 6.0 mediumEPSS 0.21%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)