Skip to contentAmazon vulnerabilities
Newest
- amazon freertos-plus-tcpMAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet ProcessingCVE-2026-74227.1 High
- amazon tough, tuftool +1 moreMultiple Path Traversal Variants in awslabs/toughCVE-2026-69687.1 High
- amazon tough, tuftool +1 moreMissing Delegated Metadata Validation in awslabs/toughCVE-2026-6967Fix available7.1 High
- amazon tough, tuftool +1 moreSignature Threshold Bypass in awslabs/tough Delegated RolesCVE-2026-6966Fix available7.0 High
- amazon linux, linux kernel, arista cloudvision agni +142 more +144 morecrypto: algif_aead - Revert to operating out-of-placeCVE-2026-31431In KEVPublic exploitFix availableEPSS 98.1%7.8 High
- amazon aws efs csi driver, efs csi driver +1 moreAWS EFS CSI Driver Mount Option InjectionCVE-2026-6437Fix available6.9 Medium
- amazon firecrackerOut-of-bounds Write in Firecracker virtio-pci TransportCVE-2026-5747Fix available8.7 High
- amazon research and engineering studio, aws research and engineering studio (res) +1 moreAWS Research and Engineering Studio (RES) FileBrowser Command InjectionCVE-2026-57097.7 High
- amazon research and engineering studio, aws research and engineering studio (res) +1 moreImproper Control of User-Modifiable Attributes in RES CreateSession APICVE-2026-57088.7 High
- amazon research and engineering studio, aws research and engineering studio (res) +1 moreCommand Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)CVE-2026-57078.7 High
- amazon athena odbc driver, athena odbc +1 moreImproper neutralization of special elements in authentication components in Amazon Athena ODBC driverCVE-2026-355587.3 High
- amazon athena odbc driver, athena odbc +1 moreOut-of-bounds write in query processing components in Amazon Athena ODBC driverCVE-2026-355597.1 High
- amazon athena odbc driver, athena odbc +1 moreOS command injection in Amazon Athena ODBC driver on LinuxCVE-2026-54857.3 High
- amazon athena odbc driver, athena odbc +1 moreAllocation of resources without limits in parsing components in Amazon Athena ODBC driverCVE-2026-355628.7 High
- amazon athena odbc driver, athena odbc +1 moreInsufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driverCVE-2026-355619.1 Critical
- amazon athena odbc driver, athena odbc +1 moreImproper certificate validation in identity provider connection components in Amazon Athena ODBC driverCVE-2026-355609.1 Critical
- amazon bedrock agentcore starter toolkitImproper S3 ownership verification in Bedrock AgentCore Starter ToolkitCVE-2026-4269Fix available5.8 Medium
- amazon aws api mcp server, aws api mcp server +1 moreAWS API MCP File Access Restriction BypassCVE-2026-4270Fix available6.8 Medium
- mariadb, mariadb foundation server, amazon aurora mysql +3 more +5 moreMariaDB Server Audit Plugin Comment Handling BypassCVE-2026-3494Public exploitFix available5.3 Medium
- aws aws-lc, amazon aws-lc-sys, aws libcrypto +7 more +9 morePKCS7_verify Signature Validation Bypass in AWS-LCCVE-2026-3338Fix available8.7 High
- aws aws-lc, amazon aws-lc-fips-sys, aws-lc-sys +2 more +4 moreTiming Side-Channel in AES-CCM Tag Verification in AWS-LCCVE-2026-3337Fix available8.2 High
- aws aws-lc, amazon aws-lc-sys, aws libcrypto +7 more +9 morePKCS7_verify Certificate Chain Validation Bypass in AWS-LCCVE-2026-3336Fix available8.7 High
- amazon firecrackerArbitrary Host File Overwrite via Symlink in Firecracker JailerCVE-2026-13866.0 Medium
- amazon kiro ideCommand Injection in Kiro GitLab Merge Request HelperCVE-2026-08308.4 High
- amazon harmonix, aws harmonix on aws +1 moreOverly Permissive Trust Policy in Harmonix on AWS EKSCVE-2025-145038.6 High
- amazon opensearchOpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoSCVE-2025-9624Fix available8.3 High
- amazon ion-cAn uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be…CVE-2025-128296.9 Medium
- amazon workspacesImproper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions...CVE-2025-127798.8 High
- amazon opensearch data prepper, opensearch-project data-prepper +1 moreOpenSearch Data Prepper plugins trusts all SSL certificates by defaultCVE-2025-62371Fix available7.4 High
- amazon freertos-plus-tcpInvalid Pointer Dereference when receiving UDP/IPv6 packets in FreeRTOS-Plus-TCPCVE-2025-116185.3 Medium
- amazon freertos-plus-tcpBuffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCPCVE-2025-116175.3 Medium
- amazon freertos-plus-tcp, aws freertos-plus tcp +1 moreBuffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCPCVE-2025-116165.3 Medium
- amazon amazon.iondotnetDenial of Service issue in Amazon.IonDotnetCVE-2025-11573Fix available8.7 High
- amazon ecsInformation Disclosure in Amazon ECS Container AgentCVE-2025-9039Fix available5.3 Medium
- amazon emrPrivilege escalation issue in Amazon EMR Secret Agent componentCVE-2025-89049.0 Critical
- amazon q developer vs code extensionInert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) ExtensionCVE-2025-82175.1 Medium
- amazon cloud camInsecure device pairing in end of life Amazon Cloud CamCVE-2025-60317.7 High
- amazon freertosOut of Bounds Write in FreeRTOS-Plus-TCPCVE-2025-5688Public exploit7.5 High
- amazon redshiftIssue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider pluginCVE-2025-5279Fix available7.0 High
- amazon amplify studioInput validation issue in AWS Amplify Studio UI component propertiesCVE-2025-4318Fix available9.0 Critical
- amazon ion dotnetInfinite loop condition in Amazon.IonDotnetCVE-2025-3857Fix available8.7 High
- amazon toughImproper timestamp caching during snapshot rollback in toughCVE-2025-2888Fix available5.7 Medium
- amazon toughFailure to detect delegated target rollback in toughCVE-2025-2887Fix available5.7 Medium
- amazon toughTerminating targets role delegations are not respected in toughCVE-2025-2886Fix available5.7 Medium
- amazon toughRoot metadata version not validated in toughCVE-2025-2885Fix available5.7 Medium
- amazon aws cloud development kit, aws cloud development kit command line interface +1 moreAWS CDK CLI prints AWS credentials retrieved by custom credential pluginsCVE-2025-2598Public exploitFix available5.7 Medium
- amazon aws cloud development kit, aws aws-cdk +1 moreIAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdkCVE-2025-23206Fix available1.8 Low
- amazon workspaces clientIssue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)CVE-2025-05017.7 High
- amazon dcv client, appstream 2.0 client, workspaces client +2 moreIssue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clientsCVE-2025-05007.7 High
- amazon redshift odbc driverSQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0CVE-2024-127468.6 High
- Show moreLoading…