AWS vulnerabilities

CVEs per yearBy the year they were published

1. 20224
2. 20232
3. 20244
4. 202527
5. 2026148

Newest CVEs

• CVE-2026-119084

  Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters

  AWS · amazon-redshift-jdbc-driver

  Critical9.2
• CVE-2026-121652

  Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

  AWS · maplibre-gl-js-amplify

  Medium4.8
• CVE-2026-119922

  Babelfish for PostgreSQL Privilege Escalation

  AWS · babelfish-for-postgresql

  High8.7
• CVE-2026-116635

  Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

  AWS · aws-serverless-mcp-server

  Medium6.9
• CVE-2026-120497

  Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

  AWS · aidlc-traceability

  Medium4.6
• CVE-2026-119085

  Template injection in the publishing component of awslabs Virtual Engineering Workbench

  AWS · virtual-engineering-workbench

  Critical9.4
• CVE-2026-119301

  Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

  AWS · aws-sdk-pandas

  Medium5.0
• CVE-2026-119117

  Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

  AWS · amazon-kinesis-producer

  High8.2
• CVE-2026-119148

  Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint

  AWS · aws-nitro-enclaves-sdk-c

  High8.2
• CVE-2026-119116

  Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c

  AWS · kmstool-enclave

  High8.7