AWS vulnerabilities
195 CVEs and advisories name AWS as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-18394Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration
- CVE-2026-18481Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft
- CVE-2026-18140Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
- CVE-2026-18245Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react
- CVE-2026-16796Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
- CVE-2026-16756Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
- CVE-2026-16584AWS API MCP Server Security Policy Bypass via Startup Failure
- CVE-2026-16317Silent Drop of TLS 1.3 Encrypted Records in s2n-tls
- CVE-2026-15957Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes
- CVE-2026-15415Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server
- CVE-2026-12283SQL injection in Amazon Athena Synapse connector
- CVE-2026-15737Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK
- CVE-2026-15895OS command injection in jsii-diff in AWS jsii
- CVE-2026-15643AWS HealthLake MCP Server SSRF via Pagination URL
- CVE-2026-14904RES Auth.GetUserPrivateKey Arbitrary File Read
- CVE-2026-14471Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry
- CVE-2026-14265RCE via Deserialization in AWS Advanced JDBC Wrapper
- CVE-2026-13760OS Command Injection in aws-cdk-lib Docker Bundling
- CVE-2026-13769Overly permissive File Permissions in AWS CLI
- CVE-2026-13763HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF
- CVE-2026-13762HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF
- CVE-2026-12530Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
- CVE-2026-11931Insecure Permissions on Authentication Token Cache File in Kiro IDE
- CVE-2026-12043Heap double-free in AWS Common Runtime aws-c-http
- CVE-2026-10740Excessive memory allocation in s2n-quic
- CVE-2026-11417OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
- CVE-2026-11393Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import
- CVE-2026-11401Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
- CVE-2026-11400Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
- CVE-2026-10584HTTPS Fallback to HTTP in Graph Explorer