Vulnerabilities in AWS
191 resultsCVE-2026-119301MEDIUMImproper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandasEPSS 0.3%CVE-2025-11618MEDIUMInvalid Pointer Dereference when receiving UDP/IPv6 packets in FreeRTOS-Plus-TCPEPSS 0.3%CVE-2026-12043HIGHHeap double-free in AWS Common Runtime aws-c-httpEPSS 0.3%CVE-2026-12530HIGHImproper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()EPSS 0.3%CVE-2026-11393HIGHCode injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent importEPSS 0.3%CVE-2025-1969MEDIUMRequest approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity CenterEPSS 0.3%CVE-2026-105811HIGHAuthorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWSEPSS 0.3%CVE-2025-2888MEDIUMImproper timestamp caching during snapshot rollback in toughEPSS 0.3%CVE-2025-2886MEDIUMTerminating targets role delegations are not respected in toughEPSS 0.3%CVE-2025-2885MEDIUMRoot metadata version not validated in toughEPSS 0.3%CVE-2025-2887MEDIUMFailure to detect delegated target rollback in toughEPSS 0.3%CVE-2025-23206LOWIAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdkEPSS 0.3%CVE-2024-45037MEDIUMAWS CDK RestApi not generating authorizationScope correctly in resultant CFN templateEPSS 0.3%CVE-2025-11617MEDIUMBuffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCPEPSS 0.3%CVE-2025-11616MEDIUMBuffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCPEPSS 0.3%CVE-2026-116635MEDIUMImproper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerEPSS 0.3%CVE-2025-2598MEDIUMAWS CDK CLI prints AWS credentials retrieved by custom credential pluginsEPSS 0.3%CVE-2025-12815MEDIUMAn ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.EPSS 0.3%CVE-2026-115845MEDIUMIncomplete validation in the run_script Python sandbox in AWS MCP ServerEPSS 0.3%CVE-2026-104002MEDIUMFail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)EPSS 0.3%