Amazon vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-112380 Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control Critical 9 · Oct 20, 2026
• CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the librarHigh 8.7 · Oct 1, 2026
• CVE-2026-95985 The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's contextHigh 8.6 · Sep 24, 2026
• CVE-2023-32803 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the roHigh 7.5 · Sep 14, 2026
• CVE-2026-85228 An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remoteHigh 8.8 · Sep 10, 2026
• CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticatHigh 7.1 · Sep 4, 2026
• CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed High 8.7 · Sep 4, 2026
• CVE-2026-85656 An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands wHigh 8.5 · Sep 4, 2026
• CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a contHigh 7.1 · Sep 4, 2026
• CVE-2026-84851 An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts theHigh 8.7 · Sep 3, 2026
• CVE-2026-81849 Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticatedHigh 8.7 · Aug 28, 2026
• CVE-2026-78379 Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to executeCritical 9.2 · Aug 25, 2026
• CVE-2026-18657 An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliHigh 8.5 · Aug 4, 2026
• CVE-2026-18656 An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a malHigh 8.5 · Aug 4, 2026
• CVE-2026-8178 An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2.Critical 9.2 · May 8, 2026
• CVE-2026-7791 Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows aHigh 8.5 · May 4, 2026
• CVE-2026-5485 OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arHigh 7.3 · Apr 3, 2026
• CVE-2026-35562 Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to cause a denial of serHigh 8.7 · Apr 3, 2026
• CVE-2026-35561 Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat acCritical 9.1 · Apr 3, 2026
• CVE-2026-35560 Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threaCritical 9.1 · Apr 3, 2026
• CVE-2026-35559 Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to crash the driver by using speciHigh 7.1 · Apr 3, 2026
• CVE-2026-35558 Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to execute aHigh 7.3 · Apr 3, 2026
• CVE-2025-12779 Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token forHigh 8.8 · Nov 5, 2025
• CVE-2025-11573 An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text inputHigh 8.7 · Oct 9, 2025
• CVE-2025-8904 Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials.Critical 9 · Aug 13, 2025