AWS vulnerabilities
195 CVEs and advisories name AWS as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-10591Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
- CVE-2026-9291Insecure Deserialization in Amazon Braket SDK Job Results Processing
- CVE-2026-9255Tool Execution Without Authorization via Piped Stdin in Kiro CLI
- CVE-2026-9133Arbitrary file read in rabbitmq-aws plugin
- CVE-2026-8838Remote Code Execution via eval() Injection in amazon-redshift-python-driver
- CVE-2026-8597Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK
- CVE-2026-8596Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path
- CVE-2026-7461OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials
- CVE-2026-7426Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP
- CVE-2026-7425Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP
- CVE-2026-7424Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP
- CVE-2026-7423Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP
- CVE-2026-7422MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing
- CVE-2026-7191Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS
- CVE-2026-6968Multiple Path Traversal Variants in awslabs/tough
- CVE-2026-6967Missing Delegated Metadata Validation in awslabs/tough
- CVE-2026-6966Signature Threshold Bypass in awslabs/tough Delegated Roles
- CVE-2026-6912Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel
- CVE-2026-6911Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel
- CVE-2026-6550Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python
- CVE-2026-5747Out-of-bounds Write in Firecracker virtio-pci Transport
- CVE-2026-5709AWS Research and Engineering Studio (RES) FileBrowser Command Injection
- CVE-2026-5708Improper Control of User-Modifiable Attributes in RES CreateSession API
- CVE-2026-5707Command Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)
- CVE-2026-5429Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme
- CVE-2026-5190AWS C Event Stream Streaming Decoder Stack Buffer Overflow
- CVE-2026-4428CRL Distribution Point Scope Check Logic Error in AWS-LC
- CVE-2026-4295Arbitrary code execution via crafted project files in Kiro IDE
- CVE-2026-4269Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
- CVE-2026-4270AWS API MCP File Access Restriction Bypass