Vulnerabilidades em AWS

191 resultados
Análise Vexday

Com 69 CVEs catalogadas e nenhuma confirmada em exploração ativa pelo CISA KEV, o perfil do AWS situa-se abaixo da média geral do catálogo nesse indicador, o que representa um panorama relativamente controlado em termos de ameaças imediatas. No entanto, 33 vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige acompanhamento contínuo. O tipo de falha mais recorrente é CWE-327 (uso de algoritmo criptográfico quebrado ou arriscado), padrão que tende a impactar a confidencialidade e integridade de dados em escala. A CVE mais relevante no momento, CVE-2025-0851, apresenta score EPSS de 0,23, e embora existam 3 CVEs com prova de conceito pública e 5 de severidade crítica, nenhuma delas atingiu exploração confirmada até o momento — condição que pode mudar rapidamente diante da disponibilidade de PoCs.

CVE-2026-87913MEDIUMMissing S3 bucket ownership verification in the AWS Security Agent MCP serverEPSS 0.4%CVE-2026-7191HIGHArbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWSEPSS 0.4%CVE-2026-103505MEDIUMAWS EFS CSI Driver Mount Option Injection via mounttargetipmapEPSS 0.4%CVE-2026-115419HIGHUnintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerEPSS 0.4%CVE-2026-18655HIGHBroker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt InjectionEPSS 0.4%CVE-2026-5190HIGHAWS C Event Stream Streaming Decoder Stack Buffer OverflowEPSS 0.4%CVE-2026-15957HIGHUncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapesEPSS 0.4%CVE-2024-34072HIGHDeserialization of Untrusted Data in sagemaker-python-sdkEPSS 0.4%CVE-2026-103957HIGHServer-side request forgery in the OAuth2 discovery handling in Loom for AWSEPSS 0.4%CVE-2026-15643CRITICALAWS HealthLake MCP Server SSRF via Pagination URLEPSS 0.4%CVE-2026-15737MEDIUMSensitive content disclosure via OpenTelemetry spans in AgentCore Python SDKEPSS 0.4%CVE-2026-92943CRITICALImproper validation of certificate with host mismatch in AWS IoT Device SDK for PythonEPSS 0.4%CVE-2026-9291HIGHInsecure Deserialization in Amazon Braket SDK Job Results ProcessingEPSS 0.4%CVE-2023-51651MEDIUMPotential URI resolution path traversal in the AWS SDK for PHPEPSS 0.4%CVE-2026-110812CRITICALDeserialization of untrusted data in the Gremlin graph-import path in Amazon NeptuneEPSS 0.4%CVE-2025-0693MEDIUMIssue with AWS Sign-in IAM User Login Flow - Possible Username EnumerationEPSS 0.4%CVE-2026-115813MEDIUMServer-side request forgery in the model download path in Amazon Web Services Multi Model ServerEPSS 0.4%CVE-2026-15415MEDIUMPath traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-serverEPSS 0.4%CVE-2026-103958HIGHServer-side request forgery in the tool server and remote agent connection handling in Loom for AWSEPSS 0.4%CVE-2026-115417HIGHMemory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqttEPSS 0.4%