Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,111All CVEsplus 18,873 rejected
- 792Last 24 hours3,273 in the last 7 days
- 17,397Last 30 days1,568 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 18 | 8 | 0 | 0 | 31 | 59 |
| 2025 | 2 | 8 | 3 | 0 | 0 | 13 | 28 |
| 2024 | 0 | 3 | 7 | 0 | 0 | 10 | 15 |
| 2023 | 0 | 1 | 1 | 0 | 0 | 2 | 5 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2019 | 1 | 0 | 0 | 0 | 0 | 1 | 2 |
| 2018 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-115415 | Secret masking bypass in the environment tool in Strands Agents Toolsamazon · strands-agents-tools | Medium5.9 |
| CVE-2026-112380 | Missing authorization in the WhatsApp channel in Kiro CrewAmazon · Kiro Crew | Critical9.0 |
| CVE-2026-110310 | RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NETAmazon · Amazon.Extensions.S3.Encryption | Medium6.0 |
| CVE-2026-104020 | Uncontrolled recursion in the Ion reader in Amazon Ion PythonAmazon · ion-python | High8.7 |
| CVE-2026-95985 | Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted WorkspacesAmazon · Kiro IDE | High8.6 |
| CVE-2026-94384 | Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce LambdaAmazon · amazon-connect-salesforce-lambda | Medium6.4 |
| CVE-2023-32803 | The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the…Amazon · ca-certificates | High7.5 |
| CVE-2026-85228 | Integer overflow in tensor buffer validation in Deep Java LibraryAmazon · Deep Java Library | High8.8 |
| CVE-2026-85787 | An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-serverAmazon · postgres-mcp-server | High7.1 |
| CVE-2026-85786 | Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-javaAmazon · ion-java | High8.7 |
| CVE-2026-85656 | OS command injection in Amazon log4j-cve-2021-44228-hotpatchAmazon · log4j-cve-2021-44228-hotpatch | High8.5 |
| CVE-2026-85654 | Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverAmazon · awslabs.dynamodb-mcp-server | High7.1 |
| CVE-2026-84851 | Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6Amazon · ion-c | High8.7 |
| CVE-2026-83497 | Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor PaginationOpenSearch · OpenSearch | High8.7 |
| CVE-2026-81849 | Path traversal in the aws:downloadContent plugin in amazon-ssm-agentamazon · amazon-ssm-agent | High8.7 |
| CVE-2026-78379 | Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents ToolsAmazon · strands-agents-tools | Critical9.2 |
| CVE-2026-18657 | Executable Resolution from Untrusted Project Directory in Kiro CLI on WindowsAmazon · Kiro CLI | High8.5 |
| CVE-2026-18656 | Executable Resolution from Untrusted Project Directory in Kiro IDE on WindowsAmazon · Kiro IDE | High8.5 |
| CVE-2026-16318 | QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tlsAmazon · s2n-tls | Medium6.9 |
| CVE-2026-15746 | Credential disclosure in Strands Agents Tools elasticsearch_memory toolAmazon · strands-agents-tools | Medium6.9 |
| CVE-2026-15738 | Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer ControllerAmazon · aws-load-balancer-controller | Medium5.8 |
| CVE-2026-8178 | Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC DriverAmazon · Amazon Redshift JDBC Driver | Critical9.2 |
| CVE-2026-7791 | Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight AgentAmazon · Workspaces | High8.5 |
| CVE-2026-6437 | AWS EFS CSI Driver Mount Option InjectionAmazon · AWS EFS CSI Driver | Medium6.9 |
| CVE-2026-35558 | Improper neutralization of special elements in authentication components in Amazon Athena ODBC driverAmazon · Amazon Athena ODBC driver | High7.3 |
| CVE-2026-35559 | Out-of-bounds write in query processing components in Amazon Athena ODBC driverAmazon · Amazon Athena ODBC driver | High7.1 |
| CVE-2026-5485 | OS command injection in Amazon Athena ODBC driver on LinuxAmazon · Amazon Athena ODBC driver | High7.3 |
| CVE-2026-35562 | Allocation of resources without limits in parsing components in Amazon Athena ODBC driverAmazon · Amazon Athena ODBC driver | High8.7 |
| CVE-2026-35561 | Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driverAmazon · Amazon Athena ODBC driver | Critical9.1 |
| CVE-2026-35560 | Improper certificate validation in identity provider connection components in Amazon Athena ODBC driverAmazon · Amazon Athena ODBC driver | Critical9.1 |
| CVE-2026-3494 | MariaDB Server Audit Plugin Comment Handling BypassMariaDB Foundation · MariaDB Server | Medium5.3 |
| CVE-2025-12829 | An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a…Amazon · Ion-C | Medium6.9 |
| CVE-2025-12779 | Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token…Amazon · Amazon WorkSpaces | High8.8 |
| CVE-2025-11573 | Denial of Service issue in Amazon.IonDotnetAmazon · Amazon.IonDotnet | High8.7 |
| CVE-2025-9039 | Information Disclosure in Amazon ECS Container AgentAmazon · ECS | Medium5.3 |
| CVE-2025-8904 | Privilege escalation issue in Amazon EMR Secret Agent componentAmazon · EMR | Critical9.0 |
| CVE-2025-8217 | Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) ExtensionAmazon · Q Developer VS Code Extension | Medium5.1 |
| CVE-2025-6031 | Insecure device pairing in end of life Amazon Cloud CamAmazon · Cloud Cam | High7.7 |
| CVE-2025-5688 | Out of Bounds Write in FreeRTOS-Plus-TCPAmazon · FreeRTOS | High7.5 |
| CVE-2025-5279 | Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider pluginAmazon · Redshift | High7.0 |
| CVE-2025-4318 | Input validation issue in AWS Amplify Studio UI component propertiesAmazon · Amplify Studio | Critical9.0 |
| CVE-2025-3857 | Infinite loop condition in Amazon.IonDotnetAmazon · Amazon Ion Dotnet | High8.7 |
| CVE-2025-0501 | Issue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)Amazon · WorkSpaces Client | High7.7 |
| CVE-2025-0500 | Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clientsAmazon · WorkSpaces Client | High7.7 |
| CVE-2024-12746 | SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0Amazon · Amazon Redshift ODBC Driver | High8.6 |
| CVE-2024-12745 | SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4Amazon · Amazon Redshift Python Connector | High8.6 |
| CVE-2024-12744 | SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31Amazon · Amazon Redshift JDBC Driver | High8.6 |
| CVE-2024-52314 | data.all admin user may access potentially sensitive data stored by producers via logsamazon · data.all | Medium6.9 |
| CVE-2024-52312 | data.all authenticated users can perform restricted operations against DataSets and Environmentsamazon · data.all | Medium5.3 |
| CVE-2024-52313 | data.all authenticated users can obtain incorrect object level authorizationsamazon · data.all | Medium5.3 |