Amazon - vulnerabilities (CVEs)
239 CVEs in 171 products, 4 in the last 30 days, newest from 2026-10-28.
Products
- Amazon Web Services Freertos - 14 CVEs
- Fire Os - 13 CVEs
- Freertos - 11 CVEs
- Opensearch - 11 CVEs
- Tough - 10 CVEs
- Freertos-plus-tcp - 9 CVEs
- Blink Xt2 Sync Module Firmware - 7 CVEs
- Amazon Athena Odbc Driver - 6 CVEs
- Athena Odbc - 6 CVEs
- Aws Software Development Kit - 6 CVEs
- Data.all - 5 CVEs
- Firecracker - 5 CVEs
- Kiro Ide - 5 CVEs
- Payfort-php-sdk - 5 CVEs
- Amazon Web Services Internet Of Things Device Software Development Kit V2 - 4 CVEs
- Aws Cloud Development Kit - 4 CVEs
- Amazon Web Services Aws-c-io - 3 CVEs
- Aws-lc-sys - 3 CVEs
- Aws Client Vpn - 3 CVEs
- Aws Libcrypto - 3 CVEs
- Echo Dot Firmware - 3 CVEs
- Opensearch Data Prepper - 3 CVEs
- Research And Engineering Studio - 3 CVEs
- Strands-agents-tools - 3 CVEs
- Tuftool - 3 CVEs
- Workspaces - 3 CVEs
- Advanced Jdbc Wrapper - 2 CVEs
- Amazon Linux - 2 CVEs
- Amazon Web Services Redshift Java Database Connectivity Driver - 2 CVEs
- Audible - 2 CVEs
- Aws Command Line Interface - 2 CVEs
- Aws Encryption Sdk - 2 CVEs
- Aws S3 Crypto Sdk - 2 CVEs
- Awslabs Sandbox Accounts For Events - 2 CVEs
- Fire Tv Stick 3rd Gen - 2 CVEs
- Kindle Firmware - 2 CVEs
- Kindle For Pc - 2 CVEs
- Kindle Touch - 2 CVEs
- Kiro Cli - 2 CVEs
- Log4jhotpatch - 2 CVEs
- Opensearch Security - 2 CVEs
- Workspaces Client - 2 CVEs
- Alexa - 1 CVEs
- Amazon-connect-salesforce-lambda - 1 CVEs
- Amazon-ssm-agent - 1 CVEs
- Amazon.applicationloadbalancer.identity.aspnetcore Middleware - 1 CVEs
- Amazon.extensions.s3.encryption - 1 CVEs
- Amazon.iondotnet - 1 CVEs
- Amazon Cloudfront - 1 CVEs
- Amazon Ecs Container Agent - 1 CVEs
- Amazon Ion Dotnet - 1 CVEs
- Amazon Key Firmware - 1 CVEs
- Amazon Music - 1 CVEs
- Amazon Music Player - 1 CVEs
- Amazon Opensearch Service - 1 CVEs
- Amazon Redshift Jdbc Driver - 1 CVEs
- Amazon Redshift Odbc Driver - 1 CVEs
- Amazon Redshift Python Connector - 1 CVEs
- Amazon Ssm Agent - 1 CVEs
- Amazon Web Services Cloudformation Bootstrap - 1 CVEs
- Amazon Workspaces - 1 CVEs
- Amplify Codegen Ui - 1 CVEs
- Amplify Studio - 1 CVEs
- Application Load Balancer - 1 CVEs
- Appstream 2.0 Client - 1 CVEs
- Aurora Mysql - 1 CVEs
- Aws-dataall - 1 CVEs
- Aws-lc-fips-sys - 1 CVEs
- Aws-load-balancer-controller - 1 CVEs
- Aws-sdk-java - 1 CVEs
- Aws-sigv4 - 1 CVEs
- Aws-smithy-json - 1 CVEs
- Aws Alb Route Directive Adapter For Istio - 1 CVEs
- Aws Amplify Cli - 1 CVEs
- Aws Api Mcp Server - 1 CVEs
- Aws Deployment Framework - 1 CVEs
- Aws Efs Csi Driver - 1 CVEs
- Aws Javascript S3 Explorer - 1 CVEs
- Aws Lambda - 1 CVEs
- Aws Opensearch - 1 CVEs
- Aws Sdk - 1 CVEs
- Aws Sdk For Javascipt - 1 CVEs
- Aws Shared Configuration File Loader - 1 CVEs
- Aws Transform Mcp Server - 1 CVEs
- Aws Workspaces - 1 CVEs
- Awslabs.dynamodb-mcp-server - 1 CVEs
- Awsui/components-react - 1 CVEs
- Bedrock Agentcore Starter Toolkit - 1 CVEs
- Ca-certificates - 1 CVEs
- Cloud Cam - 1 CVEs
- Cloudfront - 1 CVEs
- Cloudwatch Agent - 1 CVEs
- Dcv Client - 1 CVEs
- Deep Java Library - 1 CVEs
- Diagram-as-code - 1 CVEs
- Documentdb Mcp Server - 1 CVEs
- Ec2 Api Tools Java Library - 1 CVEs
- Echo Firmware - 1 CVEs
- Echo Plus Firmware - 1 CVEs
- Echo Show Firmware - 1 CVEs
- Echo Spot Firmware - 1 CVEs
- Ecs - 1 CVEs
- Efs-utils - 1 CVEs
- Efs Csi Driver - 1 CVEs
- Elastic File System Container Storage Interface Driver - 1 CVEs
- Elastic Load Balancing - 1 CVEs
- Emr - 1 CVEs
- Fhir-works-on-aws-authz-smart - 1 CVEs
- Flexible Payments Service - 1 CVEs
- Freertos+fat - 1 CVEs
- Harmonix - 1 CVEs
- Hotpatch - 1 CVEs
- Ion - 1 CVEs
- Ion-c - 1 CVEs
- Ion-java - 1 CVEs
- Ion-python - 1 CVEs
- Kindle - 1 CVEs
- Kiro Crew - 1 CVEs
- Log4j-cve-2021-44228-hotpatch - 1 CVEs
- Merchant Sdk - 1 CVEs
- Open Distro - 1 CVEs
- Opensearch Notifications - 1 CVEs
- Postgres-mcp-server - 1 CVEs
- Q Developer Vs Code Extension - 1 CVEs
- Rds For Mariadb - 1 CVEs
- Rds For Mysql - 1 CVEs
- Redshift - 1 CVEs
- Redshift Connector - 1 CVEs
- Redshift Odbc Driver - 1 CVEs
- Relational Database Service - 1 CVEs
- Ring Video Doorbell Firmware - 1 CVEs
- S2n-tls - 1 CVEs
- Sockeye - 1 CVEs
- Amazon Cloudwatch - 0 CVEs
- Amazon Freertos - 0 CVEs
- Amazon Key - 0 CVEs
- Amazon Simple Notification Service - 0 CVEs
- Amazon Simple Storage Service - 0 CVEs
- Amazon Virtual Private Cloud - 0 CVEs
- Amazon Web Services - 0 CVEs
- Amazon Web Services Software Development Kit - 0 CVEs
- Amplify Cli - 0 CVEs
- Aws-lambda - 0 CVEs
- Aws-lc-rs - 0 CVEs
- Aws Cloudformation - 0 CVEs
- Aws Cloudtrail - 0 CVEs
- Aws Config - 0 CVEs
- Aws Identity And Access Management - 0 CVEs
- Aws Marketplace - 0 CVEs
- Blink Xt2 Sync Module - 0 CVEs
- Corretto - 0 CVEs
- Echo - 0 CVEs
- Echo Dot - 0 CVEs
- Echo Plus - 0 CVEs
- Echo Show - 0 CVEs
- Echo Spot - 0 CVEs
- Elastic Load Balancing Api Tools - 0 CVEs
- Kindle Fire Hd - 0 CVEs
- Linux 2 - 0 CVEs
- Payfort - 0 CVEs
- Qnabot On Aws - 0 CVEs
- Ring Video Doorbell - 0 CVEs
- S3 Store - 0 CVEs
- Sdk Tester - 0 CVEs
- Web Services Cloudtrail - 0 CVEs
- Web Services Cloudwatch - 0 CVEs
- Web Services Config - 0 CVEs
- Web Services Identity And Access Management - 0 CVEs
- Web Services Simple Notification Service - 0 CVEs
- Web Services Simple Storage Service - 0 CVEs
- Web Services Virtual Private Cloud - 0 CVEs
Newest CVEs of Amazon
- CVE-2026-115415 - CVSS 6.5 (medium), 2026-10-28: Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the…
- CVE-2026-112380 - CVSS 9.9 (critical), 2026-10-20: Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to…
- CVE-2026-110310 - CVSS 6 (medium), 2026-10-14: A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to…
- CVE-2026-104020 - CVSS 8.7 (high), 2026-10-01: Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the…
- CVE-2026-95985 - CVSS 8.8 (high), 2026-09-24: The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's…
- CVE-2026-94384 - CVSS 8.1 (high), 2026-09-22: Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected…
- CVE-2023-32803 - CVSS 7.5 (high), 2026-09-14: The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the…
- CVE-2026-89332 - CVSS 6.7 (medium), 2026-09-11: Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote…
- CVE-2026-18061 - CVSS 6 (medium), 2026-09-11: Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor…
- CVE-2026-85228 - CVSS 9.1 (critical), 2026-09-10: An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a…
- CVE-2026-85787 - CVSS 7.1 (high), 2026-09-04: An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an…
- CVE-2026-85786 - CVSS 8.7 (high), 2026-09-04: Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted…
- CVE-2026-85656 - CVSS 8.5 (high), 2026-09-04: An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands…
- CVE-2026-85654 - CVSS 7.8 (high), 2026-09-04: Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a…
- CVE-2026-84851 - CVSS 8.7 (high), 2026-09-02: An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts…
- CVE-2026-83497 - CVSS 8.8 (high), 2026-08-31: Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic…
- CVE-2026-81849 - CVSS 8.8 (high), 2026-08-28: Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an…
- CVE-2026-81838 - CVSS 7.1 (high), 2026-08-27: A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to…
- CVE-2026-78379 - CVSS 9.2 (critical), 2026-08-25: Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to…
- CVE-2026-77237 - CVSS 8.4 (high), 2026-08-21: Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with…
- CVE-2026-77236 - CVSS 8.3 (high), 2026-08-21: Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata…
- CVE-2026-77235 - CVSS 8.3 (high), 2026-08-21: Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free…
- CVE-2026-77234 - CVSS 9.3 (critical), 2026-08-21: Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context.…
- CVE-2026-19643 - CVSS 6 (medium), 2026-08-12: An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash…
- CVE-2026-19642 - CVSS 6 (medium), 2026-08-12: An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap…
- CVE-2026-18954 - CVSS 5.7 (medium), 2026-08-05: Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to…
- CVE-2026-18953 - CVSS 8.8 (high), 2026-08-05: Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might…
- CVE-2026-18657 - CVSS 8.5 (high), 2026-08-04: An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a…
- CVE-2026-18656 - CVSS 8.5 (high), 2026-08-04: An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a…
- CVE-2026-18654 - CVSS 6.9 (medium), 2026-08-03: Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow…
