feeds - AWS Security Bulletins

home | feeds |donate

AWS Security Bulletins

cve-2026-77811 - stored cross-site scripting via integration template asset in opensearch dashboards

cve-2026-77810 - issue with athena federated query neptune connector

issue with freertos-kernel - cve-2026-77234, cve-2026-77235, cve-2026-77236, cve-2026-77237

cve-2026-18420 - remote code execution via prototype pollution in opensearch dashboards tsvb plugin

cve-2026-75910 - issue with athena federated query clickhouse connector

cve-2026-75935 and cve-2026-75936 - issue with amazon ion-java - memory-amplification denial of service

cve-2026-75897 - uncontrolled resource consumption in opensearch dashboards capabilities route

cve-2026-18428 - opensearch sql plugin - async query validation bypass

cve-2026-18952 - missing input validation in opensearch security analytics plugin

cve-2026-19642 & cve-2026-19643 - memory-safety issues in the base64 decoder in the aws sdk for c++

cve-2026-19311- missing authorization in opensearch alerting plugin

cve-2026-19111 - insecure direct object reference in strands agents tools memory tools

cve-2026-18954 - incorrect authorization in the aggregation pipeline tool in amazon aws labs documentdb mcp server

cve-2026-18953 - improper limitation of a pathname in aws transform mcp server

cve-2026-18656 & cve-2026-18657 - issue with kiro ide and cli - executable resolution from untrusted project directory on windows

cve-2026-18830 - issue with amazon bedrock agentcore harness – insufficient input validation

cve-2026-18733 - prompt injection bypasses shell tool consent gate in strands agents tools

cve-2026-18654 - disabled ssh host key verification in aws cli emr helper commands

cve-2026-18655 - broker credential and oauth token disclosure in aws labs amazon mq mcp server via prompt injection

cve-2026-18394 - incorrect authorization in strands agents tools http_request tool

cve-2026-18420 - remote code execution via prototype pollution in opensearch dashboards tsvb plugin

incomplete fix for cve-2025-4318 code injection in amazon &commat;aws-amplify/codegen-ui-react

cve-2026-18140 - uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

cve-2026-16796 - improper neutralization of argument delimiters in aws bedrock agentcore python sdk install_packages()

cve-2026-16756 - allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated slowloris denial of service

cve-2026-16584 - aws api mcp server security policy bypass via startup failure

cve-2026-16317 and cve-2026-16318: issues with s2n-tls: an open-source implementation of the tls/ssl protocols

cve-2026-15957 - uncontrolled recursion in smithy-rs generated json, cbor, and xml deserializers allows unauthenticated remote denial of service via recursive shapes

cve-2026-15415 - path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

cve-2026-12283 - issue with athena federated query synapse connector

cve-2026-15895: os command injection in jsii-diff in aws jsii

cve-2026-15737 - sensitive content disclosure via opentelemetry spans in agentcore python sdk

cve-2026-15746 - credential disclosure in strands agents tools elasticsearch_memory tool

cve-2026-15738 - issue with aws load balancer controller cross-namespace traffic interception via httproute/grpcroute priority ordering

cve-2026-15643 - aws healthlake mcp server ssrf via unvalidated pagination url

cve-2026-14904 - improper link resolution in auth.getuserprivatekey in aws research and engineering studio

cve-2026-14471 - authenticated sql injection in the metrics-service retention policy subsystem of mcp-gateway-registry

cve-2026-14265- deserialization of untrusted data in aws advanced jdbc wrapper remotequerycacheplugin

cve-2026-13760 - os command injection in nodejsfunction docker bundling in aws-cdk-lib

cve-2026-13769 – insecure file permissions in aws cli

cve-2026-13762 and cve-2026-13763 - issue with http/2 multi-frame request body inspection in aws waf

cve-2026-12957 and cve-2026-12958 - issues in language servers for aws and amazon q developer plugins

issue with containerd cri plugin - cve-2026-50195, cve-2026-53488, cve-2026-53492, cve-2026-53489, cve-2026-47262

cve-2026-12530 - improper neutralization of argument delimiters in aws bedrock agentcore python sdk install_packages()

cve-2026-11931 - insecure permissions on authentication token cache file in kiro ide

cve-2026-12043 - heap double-free in aws common runtime aws-c-http

cve-2026-10740 - excessive memory allocation in s2n-quic

cve-2026-10740 - excessive memory allocation in s2n-quic

cve-2026-11393 - code injection via improper triple-quote escaping in agentcore cli bedrock agent import

cve-2026-11400 and cve-2026-11401

cve-2026-10584 - https fallback to http in graph explorer

cve-2026-10591 - kiro ide insufficient file write restrictions to execution-sensitive paths

cve-2026-9291 - insecure deserialization in amazon braket sdk job results processing

cve-2026-9255 - tool execution without authorization via piped stdin in kiro cli

cve-2026-9133 - arbitrary file read in rabbitmq-aws plugin

cve-2026-8838 - remote code execution in amazon-redshift-python-driver

cve-2026-8686 - heap out-of-bounds read in coremqtt mqtt5 property parsing

issue with amazon sagemaker python sdk - model artifact integrity verification issues (cve-2026-8596 & cve-2026-8597)

ongoing updates on copy.fail and variants

fragnesia local privilege escalation report via esp-in-tcp in the linux kernel

dirty frag and other issues in amazon linux kernels

cve-2026-8178 - remote code execution via unsafe class loading in amazon redshift jdbc driver

cve-2026-7791 - local privilege escalation via toctou race condition in amazon workspaces skylight agent

cve-2026-7461 - os command injection in amazon ecs agent via fsx windows file server volume credentials

issue with freertos-plus-tcp - ipv6 router advertisement memory safety issues

cve-2026-7424 - integer underflow in dhcpv6 sub-option parser in freertos-plus-tcp

issue with freertos-plus-tcp - mac address validation bypass and icmp echo reply integer underflow

cve-2026-7191- arbitrary code execution via sandbox bypass in qnabot on aws

issues in tough library and tuftool cli utility

issue with aws ops wheel (cve-2026-6911 and cve-2026-6912

cve-2026-6550 - key commitment policy bypass via shared key cache in aws encryption sdk for python

cve-2026-6437 - mount option injection in amazon efs csi driver

cve-2026-5747 - out-of-bounds write in firecracker virtio-pci transport

issues with aws research and engineering studio (res)

issues with amazon athena odbc driver

cve-2026-5429 - kiro ide webview cross-site scripting via workspace color theme

cve-2026-5190 - aws c event stream streaming decoder stack buffer overflow

cve-2026-4428: issues with aws-lc - crl distribution point scope check logic error

arbitrary code execution via crafted project files in kiro ide

cve-2026-4269 - improper s3 ownership verification in bedrock agentcore starter toolkit

cve-2026-4270 - aws api mcp file access restriction bypass

mariadb server audit plugin comment handling bypass

issue with aws-lc: an open-source, general-purpose cryptographic library (cve-2026-3336, cve-2026-3337, cve-2026-3338)

security findings in sagemaker python sdk

cve-2026-1386 - arbitrary host file overwrite via symlink in firecracker jailer

unanchored account_id webhook filters for codebuild

cve-2026-0830 - command injection in kiro gitlab merge request helper

key commitment issues in s3 encryption clients

overly permissive trust policy in harmonix on aws eks

cve-2025-66478: rce in react server components

call audio termination issue in aws wickr desktop clients

privilege escalation in aurora postgresql using aws jdbc wrapper, aws go wrapper, aws nodejs wrapper, aws python wrapper, aws pgsql odbc driver

cve-2025-12829 - integer overflow issue in amazon ion-c

cve-2025-12815 - res web portal may display preview of virtual desktops that the user shouldn't have access to

improper authentication token handling in the amazon workspaces client for linux

cve-2025-31133, cve-2025-52565, cve-2025-52881 - runc container issues

buffer over-read when receiving improperly sized icmpv6 packets

cve-2025-11573 - denial of service issue in amazon.iondotnet

imds impersonation

cve-2025-11462 aws clientvpn macos client local privilege escalation

amazon q developer and kiro – prompt injection issues in kiro and q ide plugins

cve-2025-9039 - issue with amazon ecs agent introspection server

cve-2025-8904 - issue with amazon emr secret agent component

[redirected] memory dump issue in aws codebuild

security update for amazon q developer extension for visual studio code (version #1.84)

cve-2025-8069 - aws client vpn windows client local privilege escalation

cve-2025-6031 - insecure device pairing in end-of-life amazon cloud cam