Vulnerabilidades em AWS

191 resultados
Análise Vexday

Com 69 CVEs catalogadas e nenhuma confirmada em exploração ativa pelo CISA KEV, o perfil do AWS situa-se abaixo da média geral do catálogo nesse indicador, o que representa um panorama relativamente controlado em termos de ameaças imediatas. No entanto, 33 vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige acompanhamento contínuo. O tipo de falha mais recorrente é CWE-327 (uso de algoritmo criptográfico quebrado ou arriscado), padrão que tende a impactar a confidencialidade e integridade de dados em escala. A CVE mais relevante no momento, CVE-2025-0851, apresenta score EPSS de 0,23, e embora existam 3 CVEs com prova de conceito pública e 5 de severidade crítica, nenhuma delas atingiu exploração confirmada até o momento — condição que pode mudar rapidamente diante da disponibilidade de PoCs.

CVE-2025-0851CRITICALPath traversal issue in Deep Java LibraryEPSS 26.4%CVE-2026-103956CRITICALMissing authentication for critical function in Loom for AWSEPSS 2.5%CVE-2026-85012HIGHOS command injection in the Amazon CodeCatalyst blueprints SDKEPSS 2.3%CVE-2026-94450HIGHPotential denial of service when configured to send Retry packets in s2n-quicEPSS 1.9%CVE-2026-87911CRITICALRead-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-serverEPSS 1.7%CVE-2022-31159HIGHPartial Path Traversal in com.amazonaws:aws-java-sdk-s3 EPSS 1.6%CVE-2026-104019CRITICALOS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified StudioEPSS 1.4%CVE-2026-0830HIGHCommand Injection in Kiro GitLab Merge Request HelperEPSS 1.4%CVE-2026-13760HIGHOS Command Injection in aws-cdk-lib Docker BundlingEPSS 1.2%CVE-2024-34073HIGHCommand Injection in sagemaker-python-sdkEPSS 1.2%CVE-2026-9133HIGHArbitrary file read in rabbitmq-aws pluginEPSS 1.1%CVE-2026-5709HIGHAWS Research and Engineering Studio (RES) FileBrowser Command InjectionEPSS 1.1%CVE-2026-15895HIGHOS command injection in jsii-diff in AWS jsiiEPSS 1.1%CVE-2026-3337HIGHTiming Side-Channel in AES-CCM Tag Verification in AWS-LCEPSS 1.1%CVE-2026-5707HIGHCommand Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)EPSS 1.0%CVE-2026-18428HIGHSQL Query Validation Bypass in OpenSearch Direct QueryEPSS 1.0%CVE-2026-11417HIGHOS Command Injection in NodejsFunction Bundling in aws-cdk-libEPSS 1.0%CVE-2026-18245MEDIUMIncomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-reactEPSS 1.0%CVE-2026-18420HIGHRCE via Prototype Pollution in OpenSearch DashboardsEPSS 1.0%CVE-2023-35165MEDIUMAWS CDK EKS overly permissive trust policiesEPSS 0.9%