Advisoriesby Ibis
AWS security advisories
229 advisories · 128 critical or high in 12 months · latest Nov 9
60 of 229 advisories
Issues with Amazon Braket SDKCVE-2026-124034no fix yetRelative path traversal in the log export commands in AWS ParallelCluster CLICVE-2026-124033no fix yetIssues with Babelfish for Aurora PostgreSQLCVE-2026-119923no fix yetIssue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM...CVE-2026-122193no fix yetAPT package manager that affects Ubuntu and Debian operating systemsCVE-2026-109518no fix yetGluonTS arbitrary file write during archive extractionCVE-2026-119083no fix yetImproper isolation of shared resources in aws-network-policy-agent in Amazon EKSCVE-2026-122266no fix yetGuest Access to Firecracker Process Memory After a Failed Memory DiscardCVE-2026-122192no fix yetAWS API MCP Server OAuth token audience validation bypassCVE-2026-115413no fix yetRemote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection...CVE-2026-119084no fix yetStored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingCVE-2026-121652no fix yetBabelfish for PostgreSQL Privilege EscalationCVE-2026-119922no fix yetAuthorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...CVE-2026-105811no fix yetStored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...CVE-2026-120497no fix yetImproper limitation of a pathname to a restricted directory in the deployment status...CVE-2026-116635no fix yetTemplate injection in the publishing component of Virtual Engineering WorkbenchCVE-2026-119085no fix yetImproper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in...CVE-2026-119301no fix yetLinux kernel IPv4 TCP use-after-free IssueCVE-2026-98432no fix yetInsertion of sensitive information into a log file and process argument list in the...CVE-2026-119117no fix yetMissing type validation in xQueueSelectFromSet in FreeRTOS-KernelCVE-2026-119086no fix yetIssues in AWS Nitro Enclaves SDK for CCVE-2026-119116no fix yetIncorrect authorization in issuer resolution in AWS Private CA Connector for KubernetesCVE-2026-119115no fix yetNative Brotli Decoder Remote Code Execution and Memory DisclosureCVE-2026-111497no fix yetSecret masking bypass in the environment tool in Strands Agents ToolsCVE-2026-115415no fix yetUnverified ownership of the default Athena query result location in AWS SDK for pandasCVE-2026-118029no fix yetSQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)CVE-2026-115418no fix yetInteger overflow in tensor buffer validation in Deep Java LibraryCVE-2026-85228no fix yetServer-side request forgery in the Session Manager port forwarding functionality in AWS...CVE-2026-89049no fix yetIssue with projen - Path traversal and OS command injectionCVE-2026-89065no fix yetXML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePluginCVE-2026-18061no fix yetDenial of service in the event stream header decoder in AWS SDK for Go v2CVE-2026-89090no fix yeteMudhra intermediate CA key recovery in AWS trust bundlesCVE-2026-111943no fix yetAn incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs...CVE-2026-85787no fix yetStored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch DashboardsCVE-2026-84942no fix yetIssue with awslabs mysql-mcp-serverCVE-2026-85788no fix yetAWS security bulletinCVE-2026-87911no fix yetMissing S3 bucket ownership verification in the AWS Security Agent plugin for...CVE-2026-87912no fix yetIssue in Amazon Web Services Multi Model ServerCVE-2026-115812no fix yetIncomplete validation in the run_script Python sandbox in AWS MCP ServerCVE-2026-115845no fix yetUnintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerCVE-2026-115419no fix yetOS Command Injection Issue in SAM CLI Terraform HookCVE-2026-115414no fix yetMemory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in...CVE-2026-115417no fix yetIncorrect authorization checks in Amazon Athena engine version 3 query processingCVE-2026-115416no fix yetMissing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()CVE-2026-112408no fix yetPHP web runtimes (CVE-2026-109618 and CVE-2026-109619)CVE-2026-109618no fix yetCVE-2026-19642 & CVE-2026-19643CVE-2026-19642no fix yetDisabled SSH host key verification in AWS CLI EMR helper commandsCVE-2026-18654no fix yetPrompt injection bypasses shell tool consent gate in Strands Agents ToolsCVE-2026-18733no fix yetIssue with Amazon Bedrock AgentCore harness – Insufficient Input ValidationCVE-2026-18830no fix yetCVE-2026-18656 & CVE-2026-18657CVE-2026-18656no fix yetImproper limitation of a pathname in AWS Transform MCP ServerCVE-2026-18953no fix yetIncorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB...CVE-2026-18954no fix yetInsecure direct object reference in Strands Agents Tools memory toolsCVE-2026-19111no fix yetMissing Authorization in OpenSearch Alerting PluginCVE-2026-19311no fix yetMissing Input Validation in OpenSearch Security Analytics PluginCVE-2026-18952no fix yetIncorrect privilege assignment in AWS CICD-toolchain-for-serverless-applicationsCVE-2026-112407no fix yetMissing authorization in the WhatsApp channel in Kiro CrewCVE-2026-112380no fix yetCredential disclosure in Strands Agents Tools elasticsearch_memory toolCVE-2026-15746no fix yetOS command injection in jsii-diff in AWS jsiiCVE-2026-15895no fix yetSensitive content disclosure via OpenTelemetry spans in AgentCore Python SDKCVE-2026-15737no fix yet