Vulnerabilidades em AWS

191 resultados
Análise Vexday

Com 69 CVEs catalogadas e nenhuma confirmada em exploração ativa pelo CISA KEV, o perfil do AWS situa-se abaixo da média geral do catálogo nesse indicador, o que representa um panorama relativamente controlado em termos de ameaças imediatas. No entanto, 33 vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige acompanhamento contínuo. O tipo de falha mais recorrente é CWE-327 (uso de algoritmo criptográfico quebrado ou arriscado), padrão que tende a impactar a confidencialidade e integridade de dados em escala. A CVE mais relevante no momento, CVE-2025-0851, apresenta score EPSS de 0,23, e embora existam 3 CVEs com prova de conceito pública e 5 de severidade crítica, nenhuma delas atingiu exploração confirmada até o momento — condição que pode mudar rapidamente diante da disponibilidade de PoCs.

CVE-2026-89049HIGHServer-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager AgentEPSS 0.7%CVE-2026-96883HIGHType confusion in AWS pgcollection allows remote code executionEPSS 0.7%CVE-2026-86831HIGHImproper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKSEPSS 0.6%CVE-2022-46174MEDIUMRace condition during concurrent TLS mounts in efs-utilsEPSS 0.6%CVE-2026-77810CRITICALCode Injection via Gremlin Query Passthrough in Amazon Athena Neptune ConnectorEPSS 0.6%CVE-2026-13762HIGHHTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAFEPSS 0.6%CVE-2026-8596HIGHCleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve pathEPSS 0.6%CVE-2026-12283MEDIUMSQL injection in Amazon Athena Synapse connectorEPSS 0.6%CVE-2026-19311HIGHMissing Authorization in Execute Monitor API in OpenSearch Alerting PluginEPSS 0.6%CVE-2026-14471HIGHAuthenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registryEPSS 0.6%CVE-2026-18733HIGHPrompt injection bypasses shell tool consent gate in Strands Agents ToolsEPSS 0.6%CVE-2026-14904HIGHRES Auth.GetUserPrivateKey Arbitrary File ReadEPSS 0.6%CVE-2026-19643MEDIUMOut-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platformsEPSS 0.6%CVE-2026-119085CRITICALTemplate injection in the publishing component of awslabs Virtual Engineering WorkbenchEPSS 0.6%CVE-2026-6912HIGHPrivilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops WheelEPSS 0.6%CVE-2026-119922HIGHBabelfish for PostgreSQL Privilege EscalationEPSS 0.5%CVE-2026-7461HIGHOS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume CredentialsEPSS 0.5%CVE-2026-84942MEDIUMStored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch DashboardsEPSS 0.5%CVE-2026-6968HIGHMultiple Path Traversal Variants in awslabs/toughEPSS 0.5%CVE-2026-110248MEDIUMInsertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]pyEPSS 0.5%