RewindexCVEsAmazon Web Services
CVEs for Amazon Web Services
179 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-12958 Arbitrary file write in Language Servers for AWS
CVSS 7.8 highEPSS 0.19%Amazon Web Services
CVE-2026-12957 Arbitrary Code Execution in Language Servers for AWS
CVSS 7.8 highEPSS 0.23%Amazon Web Services
CVE-2026-11931 Insecure Permissions on Authentication Token Cache File in Kiro IDE
CVSS 5.5 mediumEPSS 0.12%Amazon Web Services
CVE-2026-12043 Heap double-free in AWS Common Runtime aws-c-http
CVSS 8.8 highEPSS 0.35%Amazon Web Services
CVE-2026-10740 Excessive memory allocation in s2n-quic
CVSS 5.3 mediumEPSS 0.29%Amazon Web Services
CVE-2026-11417 OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
CVSS 7.3 highEPSS 0.99%Amazon Web Services
CVE-2026-10584 HTTPS Fallback to HTTP in Graph Explorer
CVSS 5.9 mediumEPSS 0.10%Amazon Web Services
CVE-2026-9255 Tool Execution Without Authorization via Piped Stdin in Kiro CLI
CVSS 7.8 highEPSS 0.12%Amazon Web Services
CVE-2026-9133 Arbitrary file read in rabbitmq-aws plugin
CVSS 7.7 highEPSS 1.1%Amazon Web Services
CVE-2026-8838 Remote Code Execution via eval() Injection in amazon-redshift-python-driver
CVSS 9.8 criticalEPSS 0.81%Amazon Web Services
CVE-2026-7423 Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP
CVSS 5.3 mediumEPSS 0.22%Amazon Web Services
CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough
CVSS 5.9 mediumEPSS 0.53%Amazon Web Services
CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough
CVSS 5.9 mediumEPSS 0.25%Amazon Web Services
CVE-2026-6966 Signature Threshold Bypass in awslabs/tough Delegated Roles
CVSS 5.3 mediumEPSS 0.28%Amazon Web Services
CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel
CVSS 9.8 criticalEPSS 0.25%Amazon Web Services
CVE-2026-5747 Out-of-bounds Write in Firecracker virtio-pci Transport
CVSS 7.5 highEPSS 0.26%Amazon Web Services
CVE-2026-5429 Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme
CVSS 7.8 highEPSS 0.16%Amazon Web Services
CVE-2026-5190 AWS C Event Stream Streaming Decoder Stack Buffer Overflow
CVSS 7.5 highEPSS 0.41%Amazon Web Services
CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC
CVSS 7.4 highEPSS 0.26%Amazon Web Services
CVE-2026-4295 Arbitrary code execution via crafted project files in Kiro IDE
CVSS 7.8 highEPSS 0.22%Amazon Web Services
CVE-2026-4270 AWS API MCP File Access Restriction Bypass
CVSS 5.5 mediumEPSS 0.13%Amazon Web Services
CVE-2026-3338 PKCS7_verify Signature Validation Bypass in AWS-LC
CVSS 7.5 highEPSS 0.81%Amazon Web Services
CVE-2026-3337 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC
CVSS 5.9 mediumEPSS 1.1%Amazon Web Services
CVE-2026-3336 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
CVSS 7.5 highEPSS 0.78%Amazon Web Services
CVE-2026-1386 Arbitrary Host File Overwrite via Symlink in Firecracker Jailer
CVSS 6.0 mediumEPSS 0.21%Amazon Web Services
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)