Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

aws — Vulnerabilities & Security Advisories 68

Browse all 68 CVE security advisories affecting aws. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Amazon Web Services operates as a comprehensive cloud computing platform, providing infrastructure, storage, and networking solutions to enterprises globally. With 68 recorded Common Vulnerabilities and Exposures, the platform’s security landscape reflects the complexity of its vast ecosystem. Historically, identified flaws have predominantly involved cross-site scripting, remote code execution, and privilege escalation issues, often stemming from misconfigurations or third-party component dependencies rather than core hypervisor failures. Notable incidents have occasionally highlighted risks associated with shared responsibility models, where customer-side errors led to data exposure. Despite these challenges, AWS maintains robust isolation mechanisms and continuous monitoring protocols. The frequency of vulnerabilities underscores the necessity for rigorous patch management and strict access controls. Users must remain vigilant, recognizing that while the underlying infrastructure is hardened, the security of deployed workloads largely depends on proper configuration and adherence to best practices within the shared responsibility framework.

CVE IDTitleCVSSSeverityPublished
CVE-2026-7461 OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials — Amazon ECS AgentCWE-78 7.2 High2026-04-30
CVE-2026-7426 Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP — FreeRTOS-Plus-TCPCWE-787 8.1 High2026-04-29
CVE-2026-7425 Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP — FreeRTOS-Plus-TCPCWE-125 6.5 Medium2026-04-29
CVE-2026-7424 Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP — FreeRTOS-Plus-TCPCWE-191 8.1 High2026-04-29
CVE-2026-7423 Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP — FreeRTOS-Plus-TCPCWE-191 5.3 Medium2026-04-29
CVE-2026-7422 MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing — FreeRTOS-Plus-TCPCWE-290 6.5 Medium2026-04-29
CVE-2026-7191 Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS — QnABot on AWSCWE-94 7.2 High2026-04-27
CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough — toughCWE-22 5.9 Medium2026-04-24
CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough — toughCWE-345 5.9 Medium2026-04-24
CVE-2026-6966 Signature Threshold Bypass in awslabs/tough Delegated Roles — toughCWE-347 5.3 Medium2026-04-24
CVE-2026-6912 Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel — AWS Ops WheelCWE-915 8.8 High2026-04-24
CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel — AWS Ops WheelCWE-347 9.8 Critical2026-04-24
CVE-2026-6550 Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python — AWS Encryption SDK for PythonCWE-757 4.7 Medium2026-04-20
CVE-2026-5747 Out-of-bounds Write in Firecracker virtio-pci Transport — FirecrackerCWE-787 7.5 High2026-04-07
CVE-2026-5709 AWS Research and Engineering Studio (RES) FileBrowser Command Injection — Research and Engineering Studio (RES)CWE-78 8.8 High2026-04-06
CVE-2026-5708 Improper Control of User-Modifiable Attributes in RES CreateSession API — Research and Engineering Studio (RES)CWE-915 8.8 High2026-04-06
CVE-2026-5707 Command Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES) — Research and Engineering Studio (RES)CWE-78 8.8 High2026-04-06
CVE-2026-5429 Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme — Kiro IDECWE-79 7.8 High2026-04-02
CVE-2026-5190 AWS C Event Stream Streaming Decoder Stack Buffer Overflow — aws-c-event-streamCWE-787 7.5 High2026-03-31
CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC — AWS-LCCWE-299 7.4 High2026-03-19
CVE-2026-4295 Arbitrary code execution via crafted project files in Kiro IDE — Kiro IDECWE-829 7.8 High2026-03-17
CVE-2026-4269 Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit — Bedrock AgentCore Starter ToolkitCWE-340 7.5 High2026-03-16
CVE-2026-4270 AWS API MCP File Access Restriction Bypass — AWS API MCP ServerCWE-424 5.5 Medium2026-03-16
CVE-2026-3338 PKCS7_verify Signature Validation Bypass in AWS-LC — AWS-LCCWE-347 7.5 High2026-03-02
CVE-2026-3337 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC — AWS-LCCWE-208 5.9 Medium2026-03-02
CVE-2026-3336 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC — AWS-LCCWE-295 7.5 High2026-03-02
CVE-2026-1778 TLS disabled by default in select aws/sagemaker-python-sdk configurations — SageMaker Python SDKCWE-295 5.9 Medium2026-02-02
CVE-2026-1777 Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk — SageMaker Python SDKCWE-319 7.2 High2026-02-02
CVE-2026-1386 Arbitrary Host File Overwrite via Symlink in Firecracker Jailer — FirecrackerCWE-61 6.0 Medium2026-01-23
CVE-2026-22611 AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value — aws-sdk-netCWE-20 3.7 Low2026-01-10

This page lists every published CVE security advisory associated with aws. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.