AWS vulnerabilities
198 published CVEs name AWS among the affected products.
- 198Published CVEs198 of them scored
- 169Last 12 monthspublished in the last year
- 20Critical97 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-127119
Unverified ownership of the default EMR cluster log location in AWS SDK for pandas
AWS · aws-sdk-pandas
Medium5.9 - CVE-2026-125926
Server-side request forgery in the server registration and update API in mcp-gateway-registry
AWS · mcp-gateway-registry
Medium6.3 - CVE-2026-100307
Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator
AWS · mcp-gateway-registry
High8.7 - CVE-2026-126087
Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent
AWS · openjd-sessions
Critical9.4 - CVE-2026-125271
AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization
AWS · aws-api-mcp-server
High8.5 - CVE-2026-124034
Path traversal in Amazon Braket SDK local hybrid job input data download
AWS · amazon-braket-sdk
Medium5.9 - CVE-2026-124033
Relative path traversal in the log export commands in AWS ParallelCluster CLI
AWS · aws-parallelcluster
Medium5.9 - CVE-2026-119924
Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser
AWS · babelfish-for-postgresql
High7.2 - CVE-2026-119923
Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser
AWS · babelfish-for-postgresql
Critical9.3 - CVE-2026-122193
OS command injection in the example SSM documents in Trusted Remote Execution (REX)
AWS · trusted-remote-execution
Critical9.3