AWS
Page 2 of 2 — AWS CVEs from a corpus of 149, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1777 | High | 7.2 | 2026-02-02 | The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainin… |
CVE-2026-1386 | Medium | 6.0 | 2026-01-23 | A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with w… |
CVE-2026-22611 | Low | 3.7 | 2026-01-10 | AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0… |
CVE-2026-0830 | High | 7.8 | 2026-01-09 | Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before vers… |
CVE-2025-14764 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introduce a new EDK that… |
CVE-2025-14763 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to introduce a new EDK tha… |
CVE-2025-14762 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to differ… |
CVE-2025-14761 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to differe… |
CVE-2025-14760 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to differe… |
CVE-2025-14759 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to introduce a new EDK tha… |
CVE-2025-14503 | High | 7.2 | 2025-12-15 | An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumpt… |
CVE-2025-13524 | Medium | 5.7 | 2025-11-21 | Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linux may allow a call participant to conti… |
CVE-2025-12967 | High | 8.0 | 2025-11-10 | An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a… |
CVE-2025-12815 | Medium | 4.3 | 2025-11-06 | An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an aut… |
CVE-2025-11618 | Medium | 4.3 | 2025-10-10 | A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet w… |
CVE-2025-11617 | Medium | 5.4 | 2025-10-10 | A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect pay… |
CVE-2025-11616 | Medium | 5.4 | 2025-10-10 | A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain mess… |
CVE-2025-11462 | High | 7.8 | 2025-10-07 | Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges… |
CVE-2025-8069 | High | 7.8 | 2025-07-23 | During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directo… |
CVE-2025-3048 | Medium | 6.5 | 2025-03-31 | After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copie… |
CVE-2025-3047 | Medium | 6.5 | 2025-03-31 | When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the… |
CVE-2025-2888 | Medium | 4.5 | 2025-03-27 | During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, th… |
CVE-2025-2887 | Medium | 4.5 | 2025-03-27 | During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source… |
CVE-2025-2886 | Medium | 4.5 | 2025-03-27 | Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation… |
CVE-2025-2885 | Medium | 4.5 | 2025-03-27 | Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended versio… |
CVE-2025-2598 | Medium | 5.5 | 2025-03-21 | When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with th… |
CVE-2025-0508 | Medium | 5.9 | 2025-03-20 | A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lea… |
CVE-2025-1969 | Medium | 4.3 | 2025-03-04 | Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a user to modify a valid request and spoof… |
CVE-2025-0851 | Critical | 9.8 | 2025-01-29 | A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary location… |
CVE-2025-0693 | Medium | 5.3 | 2025-01-23 | Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an… |
CVE-2025-23206 | High | 8.1 | 2025-01-17 | The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS Cl… |
CVE-2024-45037 | Medium | 6.4 | 2024-08-27 | The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications… |
CVE-2024-32888 | Critical | 10.0 | 2024-05-15 | The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs)… |
CVE-2024-34073 | High | 7.8 | 2024-05-03 | sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies functio… |
CVE-2024-34072 | High | 7.8 | 2024-05-03 | sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer mo… |
CVE-2023-51651 | Medium | 6.0 | 2023-12-22 | AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix d… |
CVE-2023-35165 | Medium | 6.6 | 2023-06-23 | AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudF… |
CVE-2022-46174 | Medium | 4.2 | 2022-12-28 | efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs-utils v… |
CVE-2022-23511 | High | 7.1 | 2022-12-12 | A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-p… |
CVE-2022-31159 | High | 7.9 | 2022-07-15 | The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in t… |
CVE-2022-0071 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process… |
CVE-2022-0070 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capa… |
CVE-2021-3101 | High | 8.8 | 2022-04-19 | Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on… |
CVE-2021-3100 | High | 8.8 | 2022-04-19 | The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate pr… |
CVE-2022-24709 | High | 8.8 | 2022-02-24 | @awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multip… |
CVE-2021-40831 | Medium | 6.3 | 2021-11-23 | The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macO… |
CVE-2021-40830 | Medium | 6.3 | 2021-11-23 | The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix… |
CVE-2021-40829 | Medium | 6.3 | 2021-11-23 | Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and N… |
CVE-2021-40828 | Medium | 6.3 | 2021-11-23 | Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and… |