Vulnerabilidades em AWS

191 resultados
Análise Vexday

Com 69 CVEs catalogadas e nenhuma confirmada em exploração ativa pelo CISA KEV, o perfil do AWS situa-se abaixo da média geral do catálogo nesse indicador, o que representa um panorama relativamente controlado em termos de ameaças imediatas. No entanto, 33 vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige acompanhamento contínuo. O tipo de falha mais recorrente é CWE-327 (uso de algoritmo criptográfico quebrado ou arriscado), padrão que tende a impactar a confidencialidade e integridade de dados em escala. A CVE mais relevante no momento, CVE-2025-0851, apresenta score EPSS de 0,23, e embora existam 3 CVEs com prova de conceito pública e 5 de severidade crítica, nenhuma delas atingiu exploração confirmada até o momento — condição que pode mudar rapidamente diante da disponibilidade de PoCs.

CVE-2026-115414HIGHOS command injection in the Terraform hook in AWS SAM CLIEPSS 0.9%CVE-2026-5708HIGHImproper Control of User-Modifiable Attributes in RES CreateSession APIEPSS 0.9%CVE-2026-10591HIGHKiro IDE Insufficient File Write Restrictions to Execution-Sensitive PathsEPSS 0.8%CVE-2026-8838CRITICALRemote Code Execution via eval() Injection in amazon-redshift-python-driverEPSS 0.8%CVE-2026-83551HIGHCleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline pathEPSS 0.8%CVE-2026-18140HIGHUncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serversEPSS 0.8%CVE-2025-3047MEDIUMPath Traversal in AWS SAM CLI allows file copy to build containerEPSS 0.8%CVE-2025-12967HIGHAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticateEPSS 0.8%CVE-2024-32888CRITICALAmazon JDBC Driver for Redshift SQL Injection via line comment generationEPSS 0.8%CVE-2026-3338HIGHPKCS7_verify Signature Validation Bypass in AWS-LCEPSS 0.8%CVE-2026-16756HIGHAllocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of serviceEPSS 0.8%CVE-2026-112408CRITICALMissing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()EPSS 0.7%CVE-2026-3336HIGHPKCS7_verify Certificate Chain Validation Bypass in AWS-LCEPSS 0.7%CVE-2026-14265HIGHRCE via Deserialization in AWS Advanced JDBC WrapperEPSS 0.7%CVE-2026-16796HIGHImproper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()EPSS 0.7%CVE-2026-75897HIGHUncontrolled Resource Consumption in Capabilities Route in OpenSearch DashboardsEPSS 0.7%CVE-2022-24709HIGHCross site scripting in @awsui/components-reactEPSS 0.7%CVE-2026-86830HIGHIncorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity CenterEPSS 0.7%CVE-2026-13763HIGHHTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAFEPSS 0.7%CVE-2025-3048MEDIUMPath Traversal in AWS SAM CLI allows file copy to local cacheEPSS 0.7%