Vulnerabilidades em AWS

191 resultados
Análise Vexday

Com 69 CVEs catalogadas e nenhuma confirmada em exploração ativa pelo CISA KEV, o perfil do AWS situa-se abaixo da média geral do catálogo nesse indicador, o que representa um panorama relativamente controlado em termos de ameaças imediatas. No entanto, 33 vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige acompanhamento contínuo. O tipo de falha mais recorrente é CWE-327 (uso de algoritmo criptográfico quebrado ou arriscado), padrão que tende a impactar a confidencialidade e integridade de dados em escala. A CVE mais relevante no momento, CVE-2025-0851, apresenta score EPSS de 0,23, e embora existam 3 CVEs com prova de conceito pública e 5 de severidade crítica, nenhuma delas atingiu exploração confirmada até o momento — condição que pode mudar rapidamente diante da disponibilidade de PoCs.

CVE-2026-119301MEDIUMImproper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandasEPSS 0.3%CVE-2025-11618MEDIUMInvalid Pointer Dereference when receiving UDP/IPv6 packets in FreeRTOS-Plus-TCPEPSS 0.3%CVE-2026-12043HIGHHeap double-free in AWS Common Runtime aws-c-httpEPSS 0.3%CVE-2026-12530HIGHImproper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()EPSS 0.3%CVE-2026-11393HIGHCode injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent importEPSS 0.3%CVE-2025-1969MEDIUMRequest approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity CenterEPSS 0.3%CVE-2026-105811HIGHAuthorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWSEPSS 0.3%CVE-2025-2888MEDIUMImproper timestamp caching during snapshot rollback in toughEPSS 0.3%CVE-2025-2886MEDIUMTerminating targets role delegations are not respected in toughEPSS 0.3%CVE-2025-2885MEDIUMRoot metadata version not validated in toughEPSS 0.3%CVE-2025-2887MEDIUMFailure to detect delegated target rollback in toughEPSS 0.3%CVE-2025-23206LOWIAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdkEPSS 0.3%CVE-2024-45037MEDIUMAWS CDK RestApi not generating authorizationScope correctly in resultant CFN templateEPSS 0.3%CVE-2025-11617MEDIUMBuffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCPEPSS 0.3%CVE-2025-11616MEDIUMBuffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCPEPSS 0.3%CVE-2026-116635MEDIUMImproper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerEPSS 0.3%CVE-2025-2598MEDIUMAWS CDK CLI prints AWS credentials retrieved by custom credential pluginsEPSS 0.3%CVE-2025-12815MEDIUMAn ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.EPSS 0.3%CVE-2026-115845MEDIUMIncomplete validation in the run_script Python sandbox in AWS MCP ServerEPSS 0.3%CVE-2026-104002MEDIUMFail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)EPSS 0.3%