CVEs for Amazon Web Services

Name: Rewindex CVE index
Creator: Rewindex
License: https://creativecommons.org/licenses/by/4.0/

179 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.

Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.

CVEs per week for Amazon Web Services, last 52 weeks

Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.

2026-10-23
CVE-2026-115845 Incomplete validation in the run_script Python sandbox in AWS MCP Server
CVSS 6.4 mediumEPSS 0.31%Amazon Web Services
2026-10-23
CVE-2026-115813 Server-side request forgery in the model download path in Amazon Web Services Multi Model Server
CVSS 5.8 mediumEPSS 0.36%Amazon Web Services
2026-10-23
CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server
CVSS 9.8 criticalEPSS 0.53%Amazon Web Services
2026-10-22
CVE-2026-115417 Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
CVSS 7.5 highEPSS 0.35%Amazon Web Services
2026-10-22
CVE-2026-115419 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
CVSS 8.1 highEPSS 0.43%Amazon Web Services
2026-10-22
CVE-2026-115414 OS command injection in the Terraform hook in AWS SAM CLI
CVSS 7.8 highEPSS 0.88%Amazon Web Services
2026-10-22
CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processing
CVSS 7.7 highEPSS 0.27%Amazon Web Services
2026-10-21
CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
CVSS 8.1 highEPSS 0.74%Amazon Web Services
2026-10-21
CVE-2026-109619 RCE via stale global state
CVSS 8.1 highEPSS 100.0%Amazon Web Services Google Cloud14 incidents
2026-10-21
CVE-2026-109618 RCE via OOM corruption
CVSS 9.8 criticalEPSS 100.0%Amazon Web Services Google Cloud15 incidents
2026-10-21
CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
Not scoredEPSS 0.30%Amazon Web Services Google Cloud2 incidents
2026-10-20
CVE-2026-112407 Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
CVSS 8.8 highEPSS 0.34%Amazon Web Services
2026-10-20
CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew
CVSS 9.9 criticalEPSS 0.41%Amazon Web Services
2026-10-16
CVE-2026-102552 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver
CVSS 5.9 mediumEPSS 0.23%Amazon Web Services
2026-10-16
CVE-2026-102551 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling
CVSS 7.7 highEPSS 0.27%Amazon Web Services
2026-10-16
CVE-2026-109588 Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel
CVSS 8.8 highEPSS 0.16%Amazon Web Services
2026-10-16
CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel
CVSS 8.8 highEPSS 0.14%Amazon Web Services
2026-10-15
CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
CVSS 9.9 criticalEPSS 0.37%Amazon Web Services
2026-10-15
CVE-2026-99999 ipv4: validate checksum_start before completing checksum
CVSS 9.3 criticalEPSS 0.79%Amazon Web Services3 incidents
2026-10-14
CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
CVSS 5.3 mediumEPSS 0.51%Amazon Web Services
2026-10-14
CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
CVSS 5.3 mediumEPSS 0.53%Amazon Web Services
2026-10-09
CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
CVSS 6.5 mediumEPSS 0.30%Amazon Web Services
2026-10-09
CVE-2026-107783 Insertion of sensitive information into log file in AWS Tools for PowerShell
CVSS 5.9 mediumEPSS 0.10%Amazon Web Services
2026-10-08
CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib
CVSS 5.5 mediumEPSS 0.14%Amazon Web Services
2026-10-08
CVE-2026-107322 OS command injection in Amazon Agent Plugins for AWS databases-on-aws
CVSS 7.8 highEPSS 0.13%Amazon Web Services
2026-10-08
CVE-2026-107332 Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
CVSS 5.5 mediumEPSS 0.11%Amazon Web Services
2026-10-07
CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling
CVSS 7.7 highEPSS 0.20%Amazon Web Services
2026-10-06
CVE-2026-106032 Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import
CVSS 5.7 mediumEPSS 0.23%Amazon Web Services
2026-10-06
CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
CVSS 9.0 criticalEPSS 0.28%Amazon Web Services
2026-10-06
CVE-2026-105811 Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
CVSS 6.5 mediumEPSS 0.33%Amazon Web Services
2026-10-02
CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio
CVSS 9.0 criticalEPSS 1.4%Amazon Web Services
2026-10-02
CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS
CVSS 7.6 highEPSS 0.35%Amazon Web Services
2026-10-02
CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS
CVSS 6.2 mediumEPSS 0.40%Amazon Web Services
2026-10-02
CVE-2026-103956 Missing authentication for critical function in Loom for AWS
CVSS 10.0 criticalEPSS 2.5%Amazon Web Services
2026-10-01
CVE-2026-104002 Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
CVSS 5.3 mediumEPSS 0.31%Amazon Web Services
2026-10-01
CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python
CVSS 7.5 highEPSS 0.44%Amazon Web Services
2026-10-01
CVE-2026-97662 Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace
CVSS 8.2 highEPSS 0.14%Amazon Web Services
2026-10-01
CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap
CVSS 6.5 mediumEPSS 0.43%Amazon Web Services
2026-09-29
CVE-2026-100308 GluonTS arbitrary command execution during model deserialization
CVSS 7.8 highEPSS 0.14%Amazon Web Services
2026-09-24
CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution
CVSS 8.8 highEPSS 0.65%Amazon Web Services
2026-09-24
CVE-2026-95985 Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces
CVSS 8.8 highEPSS 0.14%Amazon Web Services
2026-09-22
CVE-2026-94450 Potential denial of service when configured to send Retry packets in s2n-quic
CVSS 7.5 highEPSS 1.9%Amazon Web Services
2026-09-22
CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
CVSS 8.1 highEPSS 0.32%Amazon Web Services
2026-09-17
CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
CVSS 8.1 highEPSS 0.38%Amazon Web Services
2026-09-16
CVE-2026-86831 Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
CVSS 8.7 highEPSS 0.64%Amazon Web Services
2026-09-14
CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
CVSS 7.2 highEPSS 0.69%Amazon Web Services
2026-09-11
CVE-2026-89332 Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration
CVSS 5.5 mediumEPSS 0.18%Amazon Web Services
2026-09-11
CVE-2026-89090 Denial of service in the event stream header decoder in AWS SDK for Go v2
CVSS 5.9 mediumEPSS 0.30%Amazon Web Services
2026-09-11
CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin
CVSS 5.9 mediumEPSS 0.46%Amazon Web Services
2026-09-11
CVE-2026-89066 OS command injection in the task synthesis component in projen
CVSS 7.8 highEPSS 0.23%Amazon Web Services

Markdown JSON