News stories · 30d
9
Advisories · 30d
36
Added to KEV · 90d
0
CVEs in the news
CVE-2026-16756 7.5CVE-2025-4318 9CVE-2026-15415 5.5CVE-2026-8596 7.2CVE-2026-8597 7.2CVE-2026-8178 8.1CVE-2026-13762 9.8CVE-2026-13763 9.8CVE-2026-15643 7.3CVE-2026-12043 8.8CVE-2026-6911 9.8CVE-2026-6912 8.8CVE-2026-110310 5.3CVE-2026-13769 5.5CVE-2026-7461 7.2CVE-2026-5190 7.5CVE-2026-97229 10CVE-2026-8838 9.8CVE-2026-108096 6.5CVE-2026-107783 5.9
Timeline (last 30 days)
- CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service — AWS Security Bulletins, 2026-10-16
- Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react — AWS Security Bulletins, 2026-10-16
- CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server — AWS Security Bulletins, 2026-10-15
- Issue with Amazon SageMaker Python SDK - Model artifact integrity verification issues (CVE-2026-8596 & CVE-2026-8597) — AWS Security Bulletins, 2026-10-15
- CVE-2026-8178 - Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver — AWS Security Bulletins, 2026-10-15
- CVE-2026-13762 and CVE-2026-13763 - Issue with HTTP/2 multi-frame request body inspection in AWS WAF — AWS Security Bulletins, 2026-10-14
- CVE-2026-15643 - AWS HealthLake MCP Server SSRF via Unvalidated Pagination URL — AWS Security Bulletins, 2026-10-14
- CVE-2026-12043 - Heap double-free in AWS Common Runtime aws-c-http — AWS Security Bulletins, 2026-10-14
- Issues with Amazon Athena ODBC Driver — AWS Security Bulletins, 2026-10-14
- Issue with AWS Ops Wheel (CVE-2026-6911 and CVE-2026-6912 — AWS Security Bulletins, 2026-10-14
- CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET — AWS Security Bulletins, 2026-10-14
- CVE-2026-13769 – Insecure file permissions in AWS CLI — AWS Security Bulletins, 2026-10-14
- CVE-2026-7461 - OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials — AWS Security Bulletins, 2026-10-14
- CVE-2026-5190 - AWS C Event Stream Streaming Decoder Stack Buffer Overflow — AWS Security Bulletins, 2026-10-14
- Issues with AWS Research and Engineering Studio (RES) — AWS Security Bulletins, 2026-10-14
- GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) — Help Net Security +3 sources, 2026-10-13
- AWS AgentCore security undone by prompt requesting credentials — The Register, 2026-10-09
- CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category — AWS Security Bulletins, 2026-10-09
- CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell — AWS Security Bulletins, 2026-10-09
- 'AgentCorruption' Puts AWS Environments at Risk With Single Prompt — Dark Reading, 2026-10-08
- CVE-2026-107608: Improper link resolution in asset bundling output handling in aws-cdk-lib — AWS Security Bulletins, 2026-10-08
- CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws — AWS Security Bulletins, 2026-10-08
- CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code — AWS Security Bulletins, 2026-10-08
- Amazon has an uncomfortably personal profile on you — Malwarebytes Labs, 2026-10-08
- CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling — AWS Security Bulletins, 2026-10-07
- CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS — AWS Security Bulletins, 2026-10-07
- AWS launches open-source AI agent sandbox to prevent YOLO mode disasters — The Register, 2026-10-07
- Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access — Datadog Security Labs, 2026-10-06
- CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution — AWS Security Bulletins, 2026-10-02
- CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS — AWS Security Bulletins, 2026-10-02
- CVE-2026-103505 - Mount Option Injection in Amazon EFS CSI Driver — AWS Security Bulletins, 2026-10-02
- CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) — AWS Security Bulletins, 2026-10-01
- CVE-2026-104020 - Uncontrolled recursion in the Ion reader in Amazon Ion Python — AWS Security Bulletins, 2026-10-01
- CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan — AWS Security Bulletins, 2026-10-01
- Amazon Bedrock AgentCore Flaws Could Expose AWS Credentials — Infosecurity Magazine, 2026-09-29
- The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub — Wiz Research, 2026-09-29
- CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution — AWS Security Bulletins, 2026-09-24
- CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins — AWS Security Bulletins, 2026-09-22
- CVE-2026-14265- Deserialization of Untrusted Data in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin — AWS Security Bulletins, 2026-09-22
- CVE-2026-13760 - OS Command Injection in NodejsFunction Docker Bundling in aws-cdk-lib — AWS Security Bulletins, 2026-09-22
- CVE-2026-14904 - Improper Link Resolution in Auth.GetUserPrivateKey in AWS Research and Engineering Studio — AWS Security Bulletins, 2026-09-22
- CVE-2026-15895: OS command injection in jsii-diff in AWS jsii — AWS Security Bulletins, 2026-09-22
- CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages() — AWS Security Bulletins, 2026-09-22
- CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Failure — AWS Security Bulletins, 2026-09-22
- From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies — Unit 42, 2026-09-21