AAmazon

Products

Exploited and recent CVEs

• CVE-2026-115415 Medium 6.5 Secret masking bypass in the environment tool in Strands Agents Tools 0.3%
• CVE-2026-112380 Critical 9.9 Missing authorization in the WhatsApp channel in Kiro Crew 0.4%
• CVE-2026-110310 Medium 5.3 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET 0.5%
• CVE-2026-104020 High 7.5 Uncontrolled recursion in the Ion reader in Amazon Ion Python 0.4%
• CVE-2026-95985 High 8.8 Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces 0.1%
• CVE-2026-94384 High 8.1 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda 0.3%
• CVE-2023-32803 High 7.5 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists becaus 0.2%
• CVE-2026-85228 Critical 9.1 Integer overflow in tensor buffer validation in Deep Java Library 0.5%
• CVE-2026-85787 Medium 6.5 An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server 0.3%
• CVE-2026-85786 High 7.5 Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java 0.6%
• CVE-2026-85656 High 7.8 OS command injection in Amazon log4j-cve-2021-44228-hotpatch 1.1%
• CVE-2026-85654 High 7.8 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server 0.2%
• CVE-2026-84851 High 7.5 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 0.6%
• CVE-2026-83497 High 8.8 Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination 1.0%
• CVE-2026-81849 High 8.8 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent 0.9%
• CVE-2026-78379 High 8.1 Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools 0.6%
• CVE-2026-18657 High 7.8 Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows 0.2%
• CVE-2026-18656 High 7.8 Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows 0.2%
• CVE-2026-16318 Medium 5.3 QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls 0.5%
• CVE-2026-15746 Medium 6.5 Credential disclosure in Strands Agents Tools elasticsearch_memory tool 0.4%
• CVE-2026-15738 High 8.5 Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller 0.6%
• CVE-2026-8178 High 8.1 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver 0.6%
• CVE-2026-7791 High 7.8 Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent 0.1%
• CVE-2026-6437 Medium 6.5 AWS EFS CSI Driver Mount Option Injection 0.6%
• CVE-2026-35558 High 7.8 Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver 0.3%
• CVE-2026-35559 Medium 6.5 Out-of-bounds write in query processing components in Amazon Athena ODBC driver 0.3%
• CVE-2026-5485 High 7.8 OS command injection in Amazon Athena ODBC driver on Linux 0.9%
• CVE-2026-35562 High 7.5 Allocation of resources without limits in parsing components in Amazon Athena ODBC driver 0.4%
• CVE-2026-35561 High 7.4 Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver 0.5%
• CVE-2026-35560 High 7.4 Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver 0.3%