Vendor
AWS
196 known vulnerabilities.
AWS at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 18 | 2 |
| Oct 2026 | 34 | 5 |
| Sep 2026 | 21 | 2 |
| Aug 2026 | 18 | 1 |
| Jul 2026 | 19 | 1 |
| Jun 2026 | 12 | 3 |
| May 2026 | 6 | 1 |
| Apr 2026 | 18 | 1 |
| Mar 2026 | 8 | 0 |
| Feb 2026 | 2 | 0 |
| Jan 2026 | 3 | 0 |
| Dec 2025 | 7 | 0 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 4 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 9 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 3 | 1 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
196 results · Feed
-
Medium 6.8
Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Lin…
-
High 8.8
Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent
Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to sub…
-
High 8.5
Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server befo…
-
Medium 5.9
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a r…
-
Medium 5.9
The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a r…
-
High 8.1
Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser
An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent …
-
Critical 9.8
Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS comman…
-
Critical 9.9
OS command injection in the example SSM documents in Trusted Remote Execution (REX)
OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as roo…
-
High 7.8
GluonTS arbitrary file write during archive extraction
Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or …
-
High 8.7
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF connt…
-
High 7.5
Guest access to Firecracker process memory after a failed memory discard
Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snap…
-
High 8.1
Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the applicati…
-
Medium 5.4
Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by po…
-
High 8.8
Babelfish for PostgreSQL Privilege Escalation
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, …
-
Medium 6.1
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files o…
-
Medium 5.0
Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user w…
-
High 8.8
Template injection in the publishing component of awslabs Virtual Engineering Workbench
Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda'…
-
High 7.9
Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Gl…
-
Medium 6.5
Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the ap…
-
Medium 6.5
Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint
Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
-
High 7.8
Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c
A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro …
-
High 8.5
Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster…
-
Medium 5.9
Unverified ownership of the default Athena query result location in AWS SDK for pandas
Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 buc…
-
High 7.8
AWS API MCP Server OAuth Token Audience Validation Bypass
Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the s…
-
High 7.3
SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha
SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQ…
-
Medium 6.4
Incomplete validation in the run_script Python sandbox in AWS MCP Server
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this…
-
Medium 5.8
Server-side request forgery in the model download path in Amazon Web Services Multi Model Server
Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no f…
-
Critical 9.8
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is ava…
-
High 7.5
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt …
-
High 8.1
Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conve…
-
High 7.8
OS command injection in the Terraform hook in AWS SAM CLI
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a cr…
-
High 7.7
Incorrect authorization checks in Amazon Athena engine version 3 query processing
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon …
-
High 8.1
Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment …
-
High 8.8
Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resourc…
-
Critical 9.9
Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate …
-
Medium 5.3
Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs wh…
-
Medium 6.5
Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted querie…
-
Medium 5.9
Insertion of sensitive information into log file in AWS Tools for PowerShell
Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts. To remediate this issue, users should…
-
Medium 5.5
Improper link resolution in asset bundling output handling in aws-cdk-lib
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users …
-
High 7.8
OS command injection in Amazon Agent Plugins for AWS databases-on-aws
An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database comman…