Vulnerabilidades em AWS

191 resultados
Análise Vexday

Com 69 CVEs catalogadas e nenhuma confirmada em exploração ativa pelo CISA KEV, o perfil do AWS situa-se abaixo da média geral do catálogo nesse indicador, o que representa um panorama relativamente controlado em termos de ameaças imediatas. No entanto, 33 vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige acompanhamento contínuo. O tipo de falha mais recorrente é CWE-327 (uso de algoritmo criptográfico quebrado ou arriscado), padrão que tende a impactar a confidencialidade e integridade de dados em escala. A CVE mais relevante no momento, CVE-2025-0851, apresenta score EPSS de 0,23, e embora existam 3 CVEs com prova de conceito pública e 5 de severidade crítica, nenhuma delas atingiu exploração confirmada até o momento — condição que pode mudar rapidamente diante da disponibilidade de PoCs.

CVE-2026-7422HIGHMAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet ProcessingEPSS 0.2%CVE-2026-119148HIGHUnvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpointEPSS 0.2%CVE-2026-115418HIGHSQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alphaEPSS 0.2%CVE-2026-85028HIGHCreation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development KitEPSS 0.2%CVE-2026-13769MEDIUMOverly permissive File Permissions in AWS CLIEPSS 0.2%CVE-2026-119115HIGHIncorrect authorization in issuer resolution in AWS Private CA Connector for KubernetesEPSS 0.2%CVE-2026-118029MEDIUMUnverified ownership of the default Athena query result location in AWS SDK for pandasEPSS 0.2%CVE-2025-14760MEDIUMMissing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that EPSS 0.2%CVE-2026-5429HIGHKiro IDE Webview Cross-Site Scripting via Workspace Color ThemeEPSS 0.2%CVE-2026-119116HIGHUse-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-cEPSS 0.2%CVE-2026-18954MEDIUMIncorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP ServerEPSS 0.2%CVE-2026-122192HIGHGuest access to Firecracker process memory after a failed memory discardEPSS 0.2%CVE-2026-119117HIGHInsertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for JavaEPSS 0.2%CVE-2026-97662MEDIUMArgument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspaceEPSS 0.1%CVE-2026-107608MEDIUMImproper link resolution in asset bundling output handling in aws-cdk-libEPSS 0.1%CVE-2026-100308HIGHGluonTS arbitrary command execution during model deserializationEPSS 0.1%CVE-2026-4270MEDIUMAWS API MCP File Access Restriction BypassEPSS 0.1%CVE-2026-107322HIGHOS command injection in Amazon Agent Plugins for AWS databases-on-awsEPSS 0.1%CVE-2026-11931MEDIUMInsecure Permissions on Authentication Token Cache File in Kiro IDEEPSS 0.1%CVE-2026-9255HIGHTool Execution Without Authorization via Piped Stdin in Kiro CLIEPSS 0.1%