[ Vendor · 27 CVEs ]
AWS
CVEs affecting AWS published in the last 30 days, plus any AWS CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-115417 | 22 Oct 2026 | CVSS 7.5 | aws-c-mqttMemory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to… | |
| CVE-2026-115419 | 22 Oct 2026 | CVSS 8.1 | AWS strands-agentsThe A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not… | |
| CVE-2026-115414 | 22 Oct 2026 | CVSS 7.8 | aws-sam-cliOS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan… | |
| CVE-2026-115416 | 22 Oct 2026 | CVSS 7.7 | AWS Amazon AthenaIncorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account… | |
| CVE-2026-112408 | 21 Oct 2026 | CVSS 8.1 | AWS Amazon SageMaker Python SDKMissing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2… | |
| CVE-2026-112407 | 20 Oct 2026 | CVSS 8.8 | AWS CICD-toolchain-for-serverless-applicationsIncorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated… | |
| CVE-2026-110812 | 15 Oct 2026 | CVSS 9.9 | AWS Amazon Neptune EngineDeserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with… | |
| CVE-2026-110248 | 14 Oct 2026 | CVSS 5.3 | AWS SageMaker Python SDKInsertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before… | |
| CVE-2026-108096 | 9 Oct 2026 | CVSS 6.5 | aws-amplify/graphql-index-transformerImproper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might… | |
| CVE-2026-107783 | 9 Oct 2026 | CVSS 5.9 | aws-tools-for-powershellInsertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's… | |
| CVE-2026-107608 | 8 Oct 2026 | CVSS 5.5 | aws-cdk-libImproper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent… | |
| CVE-2026-107322 | 8 Oct 2026 | CVSS 7.8 | aws databases-on-awsAn incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated… | |
| CVE-2026-107332 | 8 Oct 2026 | CVSS 5.5 | aws-toolkit-vscodeInsecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst… | |
| CVE-2026-107352 | 7 Oct 2026 | CVSS 7.7 | AWS Amazon AthenaMissing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query… | |
| CVE-2026-105811 | 6 Oct 2026 | CVSS 6.5 | aws qnabot-on-awsAuthorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook… | |
| CVE-2026-105812 | 6 Oct 2026 | CVSS 9.0 | aws bedrock-agentcore-starter-toolkitImproper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an… | |
| CVE-2026-106032 | 6 Oct 2026 | CVSS 5.7 | aws bedrock-agentcore-starter-toolkitServer-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before… | |
| CVE-2026-104019 | 2 Oct 2026 | CVSS 9.0 | AWS sagemaker-distributionOS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x… | |
| CVE-2026-103958 | 2 Oct 2026 | CVSS 7.6 | AWS loomServer-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote… | |
| CVE-2026-103956 | 2 Oct 2026 | CVSS 10.0 | AWS loomMissing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain… | |
| CVE-2026-103957 | 2 Oct 2026 | CVSS 6.2 | AWS loomServer-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the… | |
| CVE-2026-104002 | 1 Oct 2026 | CVSS 5.3 | AWS powertools-lambda-pythonA fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field… | |
| CVE-2026-97662 | 1 Oct 2026 | CVSS 8.2 | AWS security-agent-mcp-serverAn argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat… | |
| CVE-2026-103505 | 1 Oct 2026 | CVSS 6.5 | aws-efs-csi-driverImproper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2… | |
| CVE-2026-100308 | 29 Sep 2026 | CVSS 7.8 | AWS gluontsDeserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute… | |
| CVE-2026-96883 | 24 Sep 2026 | CVSS 8.8 | AWS pgcollectionpgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated… | |
| CVE-2026-18140 | 30 Jul 2026 | CVSS 7.5 | aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serversUncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes… | Fix |