Amazon vulnerabilities
64 CVEs and advisories name Amazon as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124848Incorrect default permissions on session transcripts and prompt history in Kiro CLI
- CVE-2026-124035Unsafe reflection in Amazon Braket Schemas error mitigation validation
- CVE-2026-119924Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser
- CVE-2026-119923Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser
- CVE-2026-119922Babelfish for PostgreSQL Privilege Escalation
- CVE-2026-115415Secret masking bypass in the environment tool in Strands Agents Tools
- CVE-2026-112380Missing authorization in the WhatsApp channel in Kiro Crew
- CVE-2026-110310RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
- CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion Python
- CVE-2026-95985Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces
- CVE-2026-94384Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
- CVE-2023-32803The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root cert
- CVE-2026-85228Integer overflow in tensor buffer validation in Deep Java Library
- CVE-2026-85787An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server
- CVE-2026-85786Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
- CVE-2026-85656OS command injection in Amazon log4j-cve-2021-44228-hotpatch
- CVE-2026-85654Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server
- CVE-2026-84851Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6
- CVE-2026-83497Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination
- CVE-2026-81849Path traversal in the aws:downloadContent plugin in amazon-ssm-agent
- CVE-2026-78379Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools
- CVE-2026-18657Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows
- CVE-2026-18656Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows
- CVE-2026-16318QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls
- CVE-2026-15746Credential disclosure in Strands Agents Tools elasticsearch_memory tool
- CVE-2026-15738Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller
- CVE-2026-8178Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
- CVE-2026-7791Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent
- CVE-2026-6437AWS EFS CSI Driver Mount Option Injection
- CVE-2026-35558Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver