Vulnerabilidades em AWS

191 resultados
Análise Vexday

Com 69 CVEs catalogadas e nenhuma confirmada em exploração ativa pelo CISA KEV, o perfil do AWS situa-se abaixo da média geral do catálogo nesse indicador, o que representa um panorama relativamente controlado em termos de ameaças imediatas. No entanto, 33 vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige acompanhamento contínuo. O tipo de falha mais recorrente é CWE-327 (uso de algoritmo criptográfico quebrado ou arriscado), padrão que tende a impactar a confidencialidade e integridade de dados em escala. A CVE mais relevante no momento, CVE-2025-0851, apresenta score EPSS de 0,23, e embora existam 3 CVEs com prova de conceito pública e 5 de severidade crítica, nenhuma delas atingiu exploração confirmada até o momento — condição que pode mudar rapidamente diante da disponibilidade de PoCs.

CVE-2026-22611LOWAWS SDK for .NET V4 adopted defense in depth enhancement for region parameter valueEPSS 0.2%CVE-2026-89066HIGHOS command injection in the task synthesis component in projenEPSS 0.2%CVE-2026-7425MEDIUMOut-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCPEPSS 0.2%CVE-2026-106032MEDIUMServer-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent importEPSS 0.2%CVE-2026-16584HIGHAWS API MCP Server Security Policy Bypass via Startup FailureEPSS 0.2%CVE-2026-7424HIGHInteger Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCPEPSS 0.2%CVE-2026-7423MEDIUMInteger Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCPEPSS 0.2%CVE-2026-4295HIGHArbitrary code execution via crafted project files in Kiro IDEEPSS 0.2%CVE-2025-11462CRITICALLocal Privilege Escalation Vulnerability in AWS Client VPN macOS ClientEPSS 0.2%CVE-2026-1386MEDIUMArbitrary Host File Overwrite via Symlink in Firecracker JailerEPSS 0.2%CVE-2025-14761MEDIUMMissing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that EPSS 0.2%CVE-2025-14762MEDIUMMissing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK thatEPSS 0.2%CVE-2026-107352MEDIUMMissing authorization checks in Amazon Athena engine version 3 request handlingEPSS 0.2%CVE-2026-81838MEDIUMZip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)EPSS 0.2%CVE-2026-119083HIGHGluonTS arbitrary file write during archive extractionEPSS 0.2%CVE-2025-8069HIGHLocal Privilege Escalation Vulnerability in AWS Client VPN Windows ClientEPSS 0.2%CVE-2026-89065MEDIUMRelative path traversal in the generated file manifest cleanup component in projenEPSS 0.2%CVE-2026-85788MEDIUMIncomplete list of disallowed inputs in awslabs mysql-mcp-serverEPSS 0.2%CVE-2026-18953MEDIUMImproper limitation of a pathname to a restricted directory in aws-transform-mcp-serverEPSS 0.2%CVE-2026-89332MEDIUMKiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace ConfigurationEPSS 0.2%