AMZN

Latest CVEs · RSS

• CVE-2026-102552 2026-10-16 · CVSS 5.9
  Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to i
• CVE-2026-102551 2026-10-16 · CVSS 7.7
  Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a
• CVE-2026-109588 2026-10-16 · CVSS 8.8
  Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU
• CVE-2026-109587 2026-10-16 · CVSS 8.8
  Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled
• CVE-2026-110812 2026-10-15 · CVSS 9.9
  Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard da
• CVE-2026-110310 2026-10-14 · CVSS 5.3
  A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to l
• CVE-2026-110248 2026-10-14 · CVSS 5.3
  Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might al
• CVE-2026-108096 2026-10-09 · CVSS 6.5
  Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authen
• CVE-2026-107783 2026-10-09 · CVSS 5.9
  Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Manag
• CVE-2026-107608 2026-10-08 · CVSS 6.8
  Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cau
• CVE-2026-107322 2026-10-08 · CVSS 8.5
  An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execu
• CVE-2026-107332 2026-10-08 · CVSS 6.8
  Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer toke
• CVE-2026-107352 2026-10-07 · CVSS 7.7
  Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS acc
• CVE-2026-106032 2026-10-06 · CVSS 5.7
  Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might a
• CVE-2026-105812 2026-10-06 · CVSS 8.8
  Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated sam
• CVE-2026-105811 2026-10-06 · CVSS 7.1
  Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solution
• CVE-2026-104019 2026-10-02 · CVSS 9.0
  OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11,
• CVE-2026-103958 2026-10-02 · CVSS 7.6
  Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obt
• CVE-2026-103957 2026-10-02 · CVSS 6.2
  Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of
• CVE-2026-103956 2026-10-02 · CVSS 10.0
  Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority
• CVE-2026-104002 2026-10-01 · CVSS 5.3
  A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that th
• CVE-2026-104020 2026-10-01 · CVSS 7.5
  Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the librar
• CVE-2026-97662 2026-10-01 · CVSS 8.2
  An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to crea
• CVE-2026-103505 2026-10-01 · CVSS 6.5
  Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow rem
• CVE-2026-100308 2026-09-29 · CVSS 7.8
  Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary op