AAWS

Products

Exploited and recent CVEs

• CVE-2026-119083 High 7.8 GluonTS arbitrary file write during archive extraction 0.2%
• CVE-2026-122266 High 8.7 Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS 0.3%
• CVE-2026-122266 High 8.7 Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS 0.3%
• CVE-2026-122192 High 7.5 Guest access to Firecracker process memory after a failed memory discard 0.2%
• CVE-2026-119084 High 8.1 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters 0.4%
• CVE-2026-121652 Medium 5.4 Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering 0.3%
• CVE-2026-119922 High 8.8 Babelfish for PostgreSQL Privilege Escalation 0.5%
• CVE-2026-116635 Medium 6.1 Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server 0.3%
• CVE-2026-120497 Medium 5.0 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows 0.2%
• CVE-2026-119085 High 8.8 Template injection in the publishing component of awslabs Virtual Engineering Workbench 0.6%
• CVE-2026-119301 High 7.9 Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas 0.3%
• CVE-2026-119117 Medium 6.5 Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java 0.2%
• CVE-2026-119148 Medium 6.5 Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint 0.2%
• CVE-2026-119116 High 7.8 Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c 0.2%
• CVE-2026-119115 High 8.5 Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes 0.2%
• CVE-2026-118029 Medium 5.9 Unverified ownership of the default Athena query result location in AWS SDK for pandas 0.2%
• CVE-2026-115413 High 7.8 AWS API MCP Server OAuth Token Audience Validation Bypass <0.1%
• CVE-2026-115418 High 7.3 SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha 0.2%
• CVE-2026-115845 Medium 6.4 Incomplete validation in the run_script Python sandbox in AWS MCP Server 0.3%
• CVE-2026-115813 Medium 5.8 Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 0.4%
• CVE-2026-115812 Critical 9.8 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 0.5%
• CVE-2026-115417 High 7.5 Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt 0.4%
• CVE-2026-115419 High 8.1 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server 0.4%
• CVE-2026-115419 High 8.1 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server 0.4%
• CVE-2026-115414 High 7.8 OS command injection in the Terraform hook in AWS SAM CLI 0.9%
• CVE-2026-115416 High 7.7 Incorrect authorization checks in Amazon Athena engine version 3 query processing 0.3%
• CVE-2026-112408 High 8.1 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() 0.7%
• CVE-2026-112407 High 8.8 Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications 0.5%
• CVE-2026-110812 Critical 9.9 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune 0.4%
• CVE-2026-110248 Medium 5.3 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py 0.5%