Amazon vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 20191
3. 20201
4. 202410
5. 202513
6. 202630
7. 20263

Newest CVEs

• CVE-2026-115415

  Secret masking bypass in the environment tool in Strands Agents Tools

  amazon · strands-agents-tools

  Medium5.9
• CVE-2026-112380

  Missing authorization in the WhatsApp channel in Kiro Crew

  Amazon · Kiro Crew

  Critical9.0
• CVE-2026-110310

  RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

  Amazon · Amazon.Extensions.S3.Encryption

  Medium6.0
• CVE-2026-104020

  Uncontrolled recursion in the Ion reader in Amazon Ion Python

  Amazon · ion-python

  High8.7
• CVE-2026-95985

  Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces

  Amazon · Kiro IDE

  High8.6
• CVE-2026-94384

  Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

  Amazon · amazon-connect-salesforce-lambda

  Medium6.4
• CVE-2023-32803

  The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the…

  Amazon · ca-certificates

  High7.5
• CVE-2026-85228

  Integer overflow in tensor buffer validation in Deep Java Library

  Amazon · Deep Java Library

  High8.8
• CVE-2026-85787

  An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

  Amazon · postgres-mcp-server

  High7.1
• CVE-2026-85786

  Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java

  Amazon · ion-java

  High8.7