Amazon vulnerabilities
64 CVEs and advisories name Amazon as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-35559Out-of-bounds write in query processing components in Amazon Athena ODBC driver
- CVE-2026-5485OS command injection in Amazon Athena ODBC driver on Linux
- CVE-2026-35562Allocation of resources without limits in parsing components in Amazon Athena ODBC driver
- CVE-2026-35561Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver
- CVE-2026-35560Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver
- CVE-2026-3494MariaDB Server Audit Plugin Comment Handling Bypass
- CVE-2025-12829An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Io
- CVE-2025-12779Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the auth
- CVE-2025-11573Denial of Service issue in Amazon.IonDotnet
- CVE-2025-9039Information Disclosure in Amazon ECS Container Agent
- CVE-2025-8904Privilege escalation issue in Amazon EMR Secret Agent component
- CVE-2025-8217Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension
- CVE-2025-6031Insecure device pairing in end of life Amazon Cloud Cam
- CVE-2025-5688Out of Bounds Write in FreeRTOS-Plus-TCP
- CVE-2025-5279Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin
- CVE-2025-4318Input validation issue in AWS Amplify Studio UI component properties
- CVE-2025-3857Infinite loop condition in Amazon.IonDotnet
- CVE-2025-0501Issue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)
- CVE-2025-0500Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients
- CVE-2024-12746SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0
- CVE-2024-12745SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4
- CVE-2024-12744SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31
- CVE-2024-52314data.all admin user may access potentially sensitive data stored by producers via logs
- CVE-2024-52312data.all authenticated users can perform restricted operations against DataSets and Environments
- CVE-2024-52313data.all authenticated users can obtain incorrect object level authorizations
- CVE-2024-10953data.all authenticated users can perform mutating update operations on persisted notification records
- CVE-2024-52311data.all does not invalidate authentication token upon user logout
- CVE-2024-10125Lack of JWT issuer and signer validation
- CVE-2024-8901Lack of JWT issuer and signer validation
- CVE-2023-1385Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to u