# cve.now: Amazon

The newest entries naming Amazon as an affected vendor (up to 200), of 64 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124848](https://cve.now/CVE-2026-124848.md): Incorrect default permissions on session transcripts and prompt history in Kiro CLI (CVSS 5.5)
- [CVE-2026-124035](https://cve.now/CVE-2026-124035.md): Unsafe reflection in Amazon Braket Schemas error mitigation validation (CVSS 7.1)
- [CVE-2026-119924](https://cve.now/CVE-2026-119924.md): Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser (CVSS 8.1)
- [CVE-2026-119923](https://cve.now/CVE-2026-119923.md): Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser (CVSS 9.8)
- [CVE-2026-119922](https://cve.now/CVE-2026-119922.md): Babelfish for PostgreSQL Privilege Escalation (CVSS 8.8)
- [CVE-2026-115415](https://cve.now/CVE-2026-115415.md): Secret masking bypass in the environment tool in Strands Agents Tools (CVSS 5.9)
- [CVE-2026-112380](https://cve.now/CVE-2026-112380.md): Missing authorization in the WhatsApp channel in Kiro Crew (CVSS 9.9)
- [CVE-2026-110310](https://cve.now/CVE-2026-110310.md): RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET (CVSS 5.3)
- [CVE-2026-104020](https://cve.now/CVE-2026-104020.md): Uncontrolled recursion in the Ion reader in Amazon Ion Python (CVSS 7.5)
- [CVE-2026-95985](https://cve.now/CVE-2026-95985.md): Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces (CVSS 8.8)
- [CVE-2026-94384](https://cve.now/CVE-2026-94384.md): Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda (CVSS 8.1)
- [CVE-2023-32803](https://cve.now/CVE-2023-32803.md): The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root cert (CVSS 7.5)
- [CVE-2026-85228](https://cve.now/CVE-2026-85228.md): Integer overflow in tensor buffer validation in Deep Java Library (CVSS 9.1)
- [CVE-2026-85787](https://cve.now/CVE-2026-85787.md): An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server (CVSS 7.1)
- [CVE-2026-85786](https://cve.now/CVE-2026-85786.md): Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java (CVSS 8.7)
- [CVE-2026-85656](https://cve.now/CVE-2026-85656.md): OS command injection in Amazon log4j-cve-2021-44228-hotpatch (CVSS 8.5)
- [CVE-2026-85654](https://cve.now/CVE-2026-85654.md): Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server (CVSS 7.1)
- [CVE-2026-84851](https://cve.now/CVE-2026-84851.md): Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 (CVSS 7.5)
- [CVE-2026-83497](https://cve.now/CVE-2026-83497.md): Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination (CVSS 8.8)
- [CVE-2026-81849](https://cve.now/CVE-2026-81849.md): Path traversal in the aws:downloadContent plugin in amazon-ssm-agent (CVSS 8.7)
- [CVE-2026-78379](https://cve.now/CVE-2026-78379.md): Consent bypass in python\_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools (CVSS 9.2)
- [CVE-2026-18657](https://cve.now/CVE-2026-18657.md): Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows (CVSS 7.8)
- [CVE-2026-18656](https://cve.now/CVE-2026-18656.md): Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows (CVSS 7.8)
- [CVE-2026-16318](https://cve.now/CVE-2026-16318.md): QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls (CVSS 5.3)
- [CVE-2026-15746](https://cve.now/CVE-2026-15746.md): Credential disclosure in Strands Agents Tools elasticsearch\_memory tool (CVSS 6.9)
- [CVE-2026-15738](https://cve.now/CVE-2026-15738.md): Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller (CVSS 5.8)
- [CVE-2026-8178](https://cve.now/CVE-2026-8178.md): Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver (CVSS 8.1)
- [CVE-2026-7791](https://cve.now/CVE-2026-7791.md): Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent (CVSS 7.8)
- [CVE-2026-6437](https://cve.now/CVE-2026-6437.md): AWS EFS CSI Driver Mount Option Injection (CVSS 6.5)
- [CVE-2026-35558](https://cve.now/CVE-2026-35558.md): Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver (CVSS 7.8)
- [CVE-2026-35559](https://cve.now/CVE-2026-35559.md): Out-of-bounds write in query processing components in Amazon Athena ODBC driver (CVSS 6.5)
- [CVE-2026-5485](https://cve.now/CVE-2026-5485.md): OS command injection in Amazon Athena ODBC driver on Linux (CVSS 7.8)
- [CVE-2026-35562](https://cve.now/CVE-2026-35562.md): Allocation of resources without limits in parsing components in Amazon Athena ODBC driver (CVSS 7.5)
- [CVE-2026-35561](https://cve.now/CVE-2026-35561.md): Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver (CVSS 7.4)
- [CVE-2026-35560](https://cve.now/CVE-2026-35560.md): Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver (CVSS 7.4)
- [CVE-2026-3494](https://cve.now/CVE-2026-3494.md): MariaDB Server Audit Plugin Comment Handling Bypass (CVSS 4.3)
- [CVE-2025-12829](https://cve.now/CVE-2025-12829.md): An uninitialized stack read issue exists in Amazon Ion-C versions \<v1.1.4 that may allow a threat actor to craft data and serialize it to Io (CVSS 6.9)
- [CVE-2025-12779](https://cve.now/CVE-2025-12779.md): Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the auth (CVSS 8.8)
- [CVE-2025-11573](https://cve.now/CVE-2025-11573.md): Denial of Service issue in Amazon.IonDotnet (CVSS 8.7)
- [CVE-2025-9039](https://cve.now/CVE-2025-9039.md): Information Disclosure in Amazon ECS Container Agent (CVSS 5.3)
- [CVE-2025-8904](https://cve.now/CVE-2025-8904.md): Privilege escalation issue in Amazon EMR Secret Agent component (CVSS 9.0)
- [CVE-2025-8217](https://cve.now/CVE-2025-8217.md): Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension (CVSS 5.1)
- [CVE-2025-6031](https://cve.now/CVE-2025-6031.md): Insecure device pairing in end of life Amazon Cloud Cam (CVSS 7.7)
- [CVE-2025-5688](https://cve.now/CVE-2025-5688.md): Out of Bounds Write in FreeRTOS-Plus-TCP (CVSS 7.5)
- [CVE-2025-5279](https://cve.now/CVE-2025-5279.md): Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin (CVSS 7.0)
- [CVE-2025-4318](https://cve.now/CVE-2025-4318.md): Input validation issue in AWS Amplify Studio UI component properties (CVSS 9.0)
- [CVE-2025-3857](https://cve.now/CVE-2025-3857.md): Infinite loop condition in Amazon.IonDotnet (CVSS 8.7)
- [CVE-2025-0501](https://cve.now/CVE-2025-0501.md): Issue affecting Amazon WorkSpaces Clients (when running PCoIP protocol) (CVSS 7.7)
- [CVE-2025-0500](https://cve.now/CVE-2025-0500.md): Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients (CVSS 7.7)
- [CVE-2024-12746](https://cve.now/CVE-2024-12746.md): SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0 (CVSS 8.6)
- [CVE-2024-12745](https://cve.now/CVE-2024-12745.md): SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4 (CVSS 8.6)
- [CVE-2024-12744](https://cve.now/CVE-2024-12744.md): SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31 (CVSS 8.6)
- [CVE-2024-52314](https://cve.now/CVE-2024-52314.md): data.all admin user may access potentially sensitive data stored by producers via logs (CVSS 6.9)
- [CVE-2024-52312](https://cve.now/CVE-2024-52312.md): data.all authenticated users can perform restricted operations against DataSets and Environments (CVSS 5.3)
- [CVE-2024-52313](https://cve.now/CVE-2024-52313.md): data.all authenticated users can obtain incorrect object level authorizations (CVSS 5.3)
- [CVE-2024-10953](https://cve.now/CVE-2024-10953.md): data.all authenticated users can perform mutating update operations on persisted notification records (CVSS 5.3)
- [CVE-2024-52311](https://cve.now/CVE-2024-52311.md): data.all does not invalidate authentication token upon user logout (CVSS 5.3)
- [CVE-2024-10125](https://cve.now/CVE-2024-10125.md): Lack of JWT issuer and signer validation (CVSS 6.9)
- [CVE-2024-8901](https://cve.now/CVE-2024-8901.md): Lack of JWT issuer and signer validation (CVSS 6.9)
- [CVE-2023-1385](https://cve.now/CVE-2023-1385.md): Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to u (CVSS 7.1)
- [CVE-2023-1384](https://cve.now/CVE-2023-1384.md): The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to b (CVSS 4.3)
- [CVE-2020-8897](https://cve.now/CVE-2020-8897.md): Robustness weakness in AWS KMS and Encryption SDKs (CVSS 4.8)
- [CVE-2019-3984](https://cve.now/CVE-2019-3984.md): Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly saniti (no CVSS)
- [CVE-2018-1169](https://cve.now/CVE-2018-1169.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/amazon
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.