AWS vulnerabilities
195 CVEs and advisories name AWS as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-3338PKCS7_verify Signature Validation Bypass in AWS-LC
- CVE-2026-3337Timing Side-Channel in AES-CCM Tag Verification in AWS-LC
- CVE-2026-3336PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
- CVE-2026-1778TLS disabled by default in select aws/sagemaker-python-sdk configurations
- CVE-2026-1777Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk
- CVE-2026-1386Arbitrary Host File Overwrite via Symlink in Firecracker Jailer
- CVE-2026-22611AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value
- CVE-2026-0830Command Injection in Kiro GitLab Merge Request Helper
- CVE-2025-14764Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introd
- CVE-2025-14763Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to intr
- CVE-2025-14762Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that
- CVE-2025-14761Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that
- CVE-2025-14760Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that
- CVE-2025-14759Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to intr
- CVE-2025-14503Overly Permissive Trust Policy in Harmonix on AWS EKS
- CVE-2025-13524Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linux may allow a call p
- CVE-2025-12967An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role.
- CVE-2025-12815An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.
- CVE-2025-11618Invalid Pointer Dereference when receiving UDP/IPv6 packets in FreeRTOS-Plus-TCP
- CVE-2025-11617Buffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCP
- CVE-2025-11616Buffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCP
- CVE-2025-11462Local Privilege Escalation Vulnerability in AWS Client VPN macOS Client
- CVE-2025-8069Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client
- CVE-2025-3048Path Traversal in AWS SAM CLI allows file copy to local cache
- CVE-2025-3047Path Traversal in AWS SAM CLI allows file copy to build container
- CVE-2025-2888Improper timestamp caching during snapshot rollback in tough
- CVE-2025-2887Failure to detect delegated target rollback in tough
- CVE-2025-2886Terminating targets role delegations are not respected in tough
- CVE-2025-2885Root metadata version not validated in tough
- CVE-2025-2598AWS CDK CLI prints AWS credentials retrieved by custom credential plugins