Amazon vulnerabilities

Products

• Freertos 22
• Web Services Freertos 14
• Fire Os 13
• Opensearch 11
• Tough 10
• Freertos-plus-tcp 9
• Blink Xt2 Sync Module Firmware 7
• Athena Odbc Driver 6
• Athena Odbc 6
• Aws Software Development Kit 6
• Data.all 5
• Firecracker 5
• Payfort-php-sdk 5
• Strands-agents-tools 5
• Web Services Internet Of Things Device Software Development Kit V2 4
• Aws Cloud Development Kit 4
• Kiro Ide 4
• Web Services Aws-c-io 3
• Aws Client Vpn 3
• Aws-lc-sys 3
• Aws Libcrypto 3
• Echo Dot Firmware 3
• Fire Tv Stick 3rd Gen 3
• Opensearch Data Prepper 3
• Research And Engineering Studio 3
• Tuftool 3
• Workspaces 3
• Advanced Jdbc Wrapper 2
• Linux 2
• Redshift Jdbc Driver 2
• Web Services Redshift Java Database Connectivity Driver 2
• Audible 2
• Aws Command Line Interface 2
• Aws Encryption Sdk 2
• Awslabs Sandbox Accounts For Events 2
• Aws S3 Crypto Sdk 2
• Aws Sdk 2
• Ion-c 2
• Kindle Firmware 2
• Kindle For Pc 2

Show 6 moreShow less

• Kindle Touch 2
• Kiro Cli 2
• Kiro Ide 2
• Log4jhotpatch 2
• Opensearch Security 2
• Workspaces Client 2

Newest

• amazon strands-agents-tools Secret masking bypass in the environment tool in Strands Agents Tools CVE-2026-115415 5.9 MediumOctober 28, 2026
• amazon kiro crew Missing authorization in the WhatsApp channel in Kiro Crew CVE-2026-112380 9.0 CriticalOctober 20, 2026
• amazon amazon.extensions.s3.encryption RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET CVE-2026-110310 6.0 MediumOctober 14, 2026
• amazon ion-python Uncontrolled recursion in the Ion reader in Amazon Ion Python CVE-2026-104020 8.7 HighOctober 1, 2026
• amazon kiro ide Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces CVE-2026-95985 8.6 HighSeptember 24, 2026
• amazon amazon-connect-salesforce-lambda Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda CVE-2026-94384 6.4 MediumSeptember 22, 2026
• amazon ca-certificates The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not... CVE-2023-32803 Fix available 7.5 HighSeptember 14, 2026
• amazon kiro ide Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration CVE-2026-89332 6.7 MediumSeptember 11, 2026
• amazon advanced jdbc wrapper Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin CVE-2026-18061 6.0 MediumSeptember 11, 2026
• amazon deep java library Integer overflow in tensor buffer validation in Deep Java Library CVE-2026-85228 8.8 HighSeptember 10, 2026
• amazon postgres-mcp-server An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server CVE-2026-85787 7.1 HighSeptember 4, 2026
• amazon ion-java Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java CVE-2026-85786 8.7 HighSeptember 4, 2026
• amazon log4j-cve-2021-44228-hotpatch OS command injection in Amazon log4j-cve-2021-44228-hotpatch CVE-2026-85656 8.5 HighSeptember 4, 2026
• amazon awslabs.dynamodb-mcp-server Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server CVE-2026-85654 7.1 HighSeptember 4, 2026
• amazon ion-c Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 CVE-2026-84851 8.7 HighSeptember 2, 2026
• opensearch, amazon opensearch service, aws amazon opensearch service +2 more Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination CVE-2026-83497 8.7 HighAugust 31, 2026
• amazon amazon-ssm-agent Path traversal in the aws:downloadContent plugin in amazon-ssm-agent CVE-2026-81849 8.7 HighAugust 28, 2026
• amazon diagram-as-code Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac) CVE-2026-81838 6.8 MediumAugust 27, 2026
• amazon strands-agents-tools Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools CVE-2026-78379 9.2 CriticalAugust 25, 2026
• amazon freertos, freertos freertos-kernel +1 more Missing type validation in xQueueAddToSet in FreeRTOS-Kernel CVE-2026-77237 8.2 HighAugust 21, 2026
• amazon freertos, freertos freertos-kernel +1 more Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel CVE-2026-77236 8.3 HighAugust 21, 2026
• amazon freertos, freertos freertos-kernel +1 more Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel CVE-2026-77235 8.3 HighAugust 21, 2026
• amazon freertos, freertos freertos-kernel +1 more Improper input validation in FreeRTOS-Kernel timer command handling CVE-2026-77234 9.3 CriticalAugust 21, 2026
• aws aws-sdk-cpp, amazon aws software development kit +1 more Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms CVE-2026-19643 Fix available 6.0 MediumAugust 12, 2026
• aws aws-sdk-cpp, amazon aws software development kit +1 more Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp CVE-2026-19642 Fix available 6.0 MediumAugust 12, 2026
• amazon strands-agents-tools Insecure direct object reference in Strands Agents Tools memory tool namespace isolation CVE-2026-19111 8.6 HighAugust 6, 2026
• amazon documentdb mcp server, aws documentdb-mcp-server +1 more Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server CVE-2026-18954 5.7 MediumAugust 5, 2026
• aws aws-transform-mcp-server, amazon aws transform mcp server +1 more Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server CVE-2026-18953 Public exploit 6.3 MediumAugust 5, 2026
• amazon kiro cli Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows CVE-2026-18657 8.5 HighAugust 4, 2026
• amazon kiro ide Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows CVE-2026-18656 8.5 HighAugust 4, 2026
• amazon strands-agents-tools Prompt injection bypasses shell tool consent gate in Strands Agents Tools CVE-2026-18733 7.5 HighAugust 3, 2026
• amazon aws command line interface, aws aws-cli +1 more Disabled SSH host key verification in Amazon AWS CLI EMR helper commands CVE-2026-18654 Fix available 6.9 MediumAugust 3, 2026
• amazon aws-smithy-json Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers CVE-2026-18140 Fix available 8.7 HighJuly 30, 2026
• amazon amplify codegen ui Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react CVE-2026-18245 6.4 MediumJuly 30, 2026
• amazon s2n-tls QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls CVE-2026-16318 Fix available 6.9 MediumJuly 21, 2026
• amazon strands-agents-tools Credential disclosure in Strands Agents Tools elasticsearch_memory tool CVE-2026-15746 6.9 MediumJuly 15, 2026
• amazon aws-load-balancer-controller Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller CVE-2026-15738 5.8 MediumJuly 14, 2026
• amazon advanced jdbc wrapper RCE via Deserialization in AWS Advanced JDBC Wrapper CVE-2026-14265 7.7 HighJuly 1, 2026
• aws cli, amazon aws command line interface +1 more Overly permissive File Permissions in AWS CLI CVE-2026-13769 Fix available 6.8 MediumJuly 1, 2026
• amazon application load balancer HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF CVE-2026-13763 7.9 HighJune 29, 2026
• amazon cloudfront, aws amazon cloudfront +1 more HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVE-2026-13762 7.9 HighJune 29, 2026
• amazon kiro ide Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths CVE-2026-10591 8.6 HighJune 2, 2026
• amazon kiro cli Tool Execution Without Authorization via Piped Stdin in Kiro CLI CVE-2026-9255 8.4 HighMay 22, 2026
• amazon redshift jdbc driver Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver CVE-2026-8178 Fix available 9.2 CriticalMay 8, 2026
• @turbo workspaces Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent CVE-2026-7791 Public exploit 8.5 HighMay 4, 2026
• aws amazon ecs agent, amazon ecs container agent +1 more OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials CVE-2026-7461 Fix available 7.5 HighApril 30, 2026
• amazon freertos-plus-tcp Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP CVE-2026-7426 6.1 MediumApril 29, 2026
• amazon freertos-plus-tcp Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP CVE-2026-7425 6.0 MediumApril 29, 2026
• amazon freertos-plus-tcp Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP CVE-2026-7424 7.2 HighApril 29, 2026
• amazon freertos-plus-tcp Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP CVE-2026-7423 6.0 MediumApril 29, 2026
• Show olderLoading…