Vulnerabilities in Amazon
63 resultsCVE-2026-115415MEDIUMSecret masking bypass in the environment tool in Strands Agents ToolsEPSS 0.3%CVE-2026-85787HIGHAn incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-serverEPSS 0.3%CVE-2023-1385HIGHImproper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to uEPSS 0.3%CVE-2026-94384MEDIUMMissing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce LambdaEPSS 0.3%CVE-2024-52313MEDIUMdata.all authenticated users can obtain incorrect object level authorizationsEPSS 0.3%CVE-2025-5279HIGHIssue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider pluginEPSS 0.3%CVE-2024-10953MEDIUMdata.all authenticated users can perform mutating update operations on persisted notification recordsEPSS 0.3%CVE-2026-3494MEDIUMMariaDB Server Audit Plugin Comment Handling BypassEPSS 0.3%CVE-2025-6031HIGHInsecure device pairing in end of life Amazon Cloud CamEPSS 0.3%CVE-2025-9039MEDIUMInformation Disclosure in Amazon ECS Container AgentEPSS 0.3%CVE-2026-35559HIGHOut-of-bounds write in query processing components in Amazon Athena ODBC driverEPSS 0.3%CVE-2026-35560CRITICALImproper certificate validation in identity provider connection components in Amazon Athena ODBC driverEPSS 0.3%CVE-2026-35558HIGHImproper neutralization of special elements in authentication components in Amazon Athena ODBC driverEPSS 0.3%CVE-2023-32803HIGHThe ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certEPSS 0.2%CVE-2025-8217MEDIUMInert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) ExtensionEPSS 0.2%CVE-2026-18657HIGHExecutable Resolution from Untrusted Project Directory in Kiro CLI on WindowsEPSS 0.2%CVE-2026-18656HIGHExecutable Resolution from Untrusted Project Directory in Kiro IDE on WindowsEPSS 0.2%CVE-2026-85654HIGHCode injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverEPSS 0.2%CVE-2025-12779HIGHImproper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authEPSS 0.2%CVE-2025-12829MEDIUMAn uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to IoEPSS 0.2%