RewindexCVEsAmazon Web Services
CVEs for Amazon Web Services
179 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library
CVSS 9.1 criticalEPSS 0.54%Amazon Web Services
CVE-2026-85788 Incomplete list of disallowed inputs in awslabs mysql-mcp-server
CVSS 5.5 mediumEPSS 0.18%Amazon Web Services
CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver
CVSS 8.7 highEPSS 0.44%Amazon Web Services
CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
CVSS 7.1 highEPSS 0.20%Amazon Web Services
CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector
CVSS 9.9 criticalEPSS 0.63%Amazon Web Services
CVE-2026-18420 RCE via Prototype Pollution in OpenSearch Dashboards
CVSS 8.8 highEPSS 0.96%Amazon Web Services
CVE-2026-18428 SQL Query Validation Bypass in OpenSearch Direct Query
CVSS 8.8 highEPSS 1.00%Amazon Web ServicesGitHub
CVE-2026-19642 Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp
CVSS 5.9 mediumEPSS 0.50%Amazon Web Services
CVE-2026-16584 AWS API MCP Server Security Policy Bypass via Startup Failure
CVSS 7.0 highEPSS 0.23%Amazon Web Services
CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls
CVSS 6.5 mediumEPSS 0.25%Amazon Web Services
CVE-2026-12283 SQL injection in Amazon Athena Synapse connector
CVSS 6.8 mediumEPSS 0.59%Amazon Web Services
CVE-2026-15895 OS command injection in jsii-diff in AWS jsii
CVSS 7.8 highEPSS 1.1%Amazon Web Services
CVE-2026-15643 AWS HealthLake MCP Server SSRF via Pagination URL
CVSS 7.3 highEPSS 0.39%Amazon Web Services
CVE-2026-14904 RES Auth.GetUserPrivateKey Arbitrary File Read
CVSS 6.5 mediumEPSS 0.57%Amazon Web Services
CVE-2026-14265 RCE via Deserialization in AWS Advanced JDBC Wrapper
CVSS 7.5 highEPSS 0.73%Amazon Web Services
CVE-2026-13760 OS Command Injection in aws-cdk-lib Docker Bundling
CVSS 7.3 highEPSS 1.2%Amazon Web Services
CVE-2026-13769 Overly permissive File Permissions in AWS CLI
CVSS 5.5 mediumEPSS 0.17%Amazon Web Services
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)