Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,204All CVEsplus 18,875 rejected
- 814Last 24 hours3,095 in the last 7 days
- 17,397Last 30 days1,564 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 14 | 84 | 49 | 1 | 0 | 148 | 185 |
| 2025 | 2 | 3 | 21 | 1 | 0 | 27 | 37 |
| 2024 | 1 | 2 | 1 | 0 | 0 | 4 | 10 |
| 2023 | 0 | 0 | 2 | 0 | 0 | 2 | 6 |
| 2022 | 0 | 3 | 1 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-119084 | Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection ParametersAWS · amazon-redshift-jdbc-driver | Critical9.2 |
| CVE-2026-121652 | Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingAWS · maplibre-gl-js-amplify | Medium4.8 |
| CVE-2026-119922 | Babelfish for PostgreSQL Privilege EscalationAWS · babelfish-for-postgresql | High8.7 |
| CVE-2026-116635 | Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerAWS · aws-serverless-mcp-server | Medium6.9 |
| CVE-2026-120497 | Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsAWS · aidlc-traceability | Medium4.6 |
| CVE-2026-119085 | Template injection in the publishing component of awslabs Virtual Engineering WorkbenchAWS · virtual-engineering-workbench | Critical9.4 |
| CVE-2026-119301 | Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandasAWS · aws-sdk-pandas | Medium5.0 |
| CVE-2026-119117 | Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for JavaAWS · amazon-kinesis-producer | High8.2 |
| CVE-2026-119148 | Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpointAWS · aws-nitro-enclaves-sdk-c | High8.2 |
| CVE-2026-119116 | Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-cAWS · kmstool-enclave | High8.7 |
| CVE-2026-119115 | Incorrect authorization in issuer resolution in AWS Private CA Connector for KubernetesAWS · aws-privateca-issuer | High8.4 |
| CVE-2026-118029 | Unverified ownership of the default Athena query result location in AWS SDK for pandasaws · aws-sdk-pandas | Medium5.9 |
| CVE-2026-115413 | AWS API MCP Server OAuth Token Audience Validation BypassAWS · aws-api-mcp-server | High7.3 |
| CVE-2026-115418 | SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alphaAWS · aws-cdk/aws-redshift-alpha | High7.0 |
| CVE-2026-115845 | Incomplete validation in the run_script Python sandbox in AWS MCP ServerAWS · AWS MCP Server | Medium5.3 |
| CVE-2026-115813 | Server-side request forgery in the model download path in Amazon Web Services Multi Model ServerAWS · multi-model-server | Medium6.9 |
| CVE-2026-115812 | Relative path traversal during model archive extraction in Amazon Web Services Multi Model ServerAWS · multi-model-server | Critical9.3 |
| CVE-2026-115417 | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqttAWS · aws-c-mqtt | High8.2 |
| CVE-2026-115419 | Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerAWS · strands-agents | High8.6 |
| CVE-2026-115414 | OS command injection in the Terraform hook in AWS SAM CLIAWS · aws-sam-cli | High8.4 |
| CVE-2026-115416 | Incorrect authorization checks in Amazon Athena engine version 3 query processingAWS · Amazon Athena | Medium6.3 |
| CVE-2026-112408 | Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()AWS · Amazon SageMaker Python SDK | Critical9.4 |
| CVE-2026-112407 | Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applicationsAWS · CICD-toolchain-for-serverless-applications | High8.7 |
| CVE-2026-110812 | Deserialization of untrusted data in the Gremlin graph-import path in Amazon NeptuneAWS · Amazon Neptune Engine | Critical9.4 |
| CVE-2026-110248 | Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]pyAWS · SageMaker Python SDK | Medium6.0 |
| CVE-2026-108096 | Improper authorization in query resolvers for SQL-backed models in AWS Amplify API CategoryAWS · aws-amplify/graphql-index-transformer | High7.1 |
| CVE-2026-107783 | Insertion of sensitive information into log file in AWS Tools for PowerShellAWS · aws-tools-for-powershell | Medium6.7 |
| CVE-2026-107608 | Improper link resolution in asset bundling output handling in aws-cdk-libAWS · aws-cdk-lib | Medium6.8 |
| CVE-2026-107322 | OS command injection in Amazon Agent Plugins for AWS databases-on-awsaws · databases-on-aws | High8.5 |
| CVE-2026-107332 | Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Codeaws · aws-toolkit-vscode | Medium6.8 |
| CVE-2026-107352 | Missing authorization checks in Amazon Athena engine version 3 request handlingAWS · Amazon Athena | Medium6.3 |
| CVE-2026-106032 | Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent importaws · bedrock-agentcore-starter-toolkit | Medium5.7 |
| CVE-2026-105812 | Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent importaws · bedrock-agentcore-starter-toolkit | High8.8 |
| CVE-2026-105811 | Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWSaws · qnabot-on-aws | High7.1 |
| CVE-2026-104019 | OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified StudioAWS · sagemaker-distribution | Critical9.3 |
| CVE-2026-103958 | Server-side request forgery in the tool server and remote agent connection handling in Loom for AWSAWS · loom | High8.3 |
| CVE-2026-103957 | Server-side request forgery in the OAuth2 discovery handling in Loom for AWSAWS · loom | High8.2 |
| CVE-2026-103956 | Missing authentication for critical function in Loom for AWSAWS · loom | Critical10.0 |
| CVE-2026-104002 | Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)AWS · powertools-lambda-python | Medium6.0 |
| CVE-2026-97662 | Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspaceAWS · security-agent-mcp-server | Medium6.9 |
| CVE-2026-103505 | AWS EFS CSI Driver Mount Option Injection via mounttargetipmapAWS · aws-efs-csi-driver | Medium6.9 |
| CVE-2026-100308 | GluonTS arbitrary command execution during model deserializationAWS · gluonts | High8.4 |
| CVE-2026-96883 | Type confusion in AWS pgcollection allows remote code executionAWS · pgcollection | High8.7 |
| CVE-2026-94450 | Potential denial of service when configured to send Retry packets in s2n-quicAWS · s2n-quic | High8.7 |
| CVE-2026-92943 | Improper validation of certificate with host mismatch in AWS IoT Device SDK for PythonAWS · AWSIoTPythonSDK | Critical9.2 |
| CVE-2026-86831 | Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKSAWS · aws-network-policy-agent | High8.7 |
| CVE-2026-86830 | Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity CenterAWS · iam-identity-center-team | High8.6 |
| CVE-2026-89332 | Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace ConfigurationAWS · Kiro IDE | Medium6.7 |
| CVE-2026-89090 | Denial of service in the event stream header decoder in AWS SDK for Go v2AWS · AWS SDK for Go v2 | High8.2 |
| CVE-2026-18061 | Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePluginAWS · AWS Advanced JDBC Wrapper | Medium6.0 |