CVEs for Amazon Web Services

Name: Rewindex CVE index
Creator: Rewindex
License: https://creativecommons.org/licenses/by/4.0/

19 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.

Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.

CVEs per week for Amazon Web Services, last 52 weeks

Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.

2026-10-23
CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server
CVSS 9.8 criticalEPSS 0.53%Amazon Web Services
2026-10-21
CVE-2026-109618 RCE via OOM corruption
CVSS 9.8 criticalEPSS 100.0%Amazon Web Services Google Cloud15 incidents
2026-10-20
CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew
CVSS 9.9 criticalEPSS 0.41%Amazon Web Services
2026-10-15
CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
CVSS 9.9 criticalEPSS 0.37%Amazon Web Services
2026-10-15
CVE-2026-99999 ipv4: validate checksum_start before completing checksum
CVSS 9.3 criticalEPSS 0.79%Amazon Web Services3 incidents
2026-10-06
CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
CVSS 9.0 criticalEPSS 0.28%Amazon Web Services
2026-10-02
CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio
CVSS 9.0 criticalEPSS 1.4%Amazon Web Services
2026-10-02
CVE-2026-103956 Missing authentication for critical function in Loom for AWS
CVSS 10.0 criticalEPSS 2.5%Amazon Web Services
2026-09-10
CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent
CVSS 9.9 criticalEPSS 0.66%Amazon Web Services
2026-09-10
CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library
CVSS 9.1 criticalEPSS 0.54%Amazon Web Services
2026-09-09
CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server
CVSS 9.6 criticalEPSS 1.7%Amazon Web Services
2026-08-21
CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector
CVSS 9.9 criticalEPSS 0.63%Amazon Web Services
2026-07-30
CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react
CVSS 9.0 criticalEPSS 0.99%Amazon Web Services
2026-06-29
CVE-2026-13763 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF
CVSS 9.8 criticalEPSS 0.68%Amazon Web Services
2026-06-29
CVE-2026-13762 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF
CVSS 9.8 criticalEPSS 0.63%Amazon Web Services
2026-06-08
CVE-2026-11393 Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import
CVSS 9.0 criticalEPSS 0.34%Amazon Web Services
2026-05-18
CVE-2026-8838 Remote Code Execution via eval() Injection in amazon-redshift-python-driver
CVSS 9.8 criticalEPSS 0.81%Amazon Web Services
2026-04-24
CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel
CVSS 9.8 criticalEPSS 0.25%Amazon Web Services
2025-01-29
CVE-2025-0851 Path traversal issue in Deep Java Library
CVSS 9.8 criticalEPSS 23.3%Amazon Web Services

Markdown JSON