AM
Vendor
Amazon
263
CVEs
1
On KEV
3
New 30D
Products
KC9.9
Kiro Crew
Amazon
1 CVEs0 on KEV1 new
AM5.3
Amazon.Extensions.S3.Encryption
Amazon
1 CVEs0 on KEV1 new
IO7.5
ion-python
Amazon
1 CVEs0 on KEV1 new
AL8.1
Amazon Linux
Amazon
2 CVEs1 on KEV0 new
FR9.8
Freertos
Amazon
21 CVEs0 on KEV0 new
AW8.1
Amazon Web Services Freertos
Amazon
14 CVEs0 on KEV0 new
FO9.8
Fire OS
Amazon
13 CVEs0 on KEV0 new
OP8.8
Opensearch
Amazon
11 CVEs0 on KEV0 new
TO8.6
Tough
Amazon
10 CVEs0 on KEV0 new
FR8.1
Freertos-plus-tcp
Amazon
9 CVEs0 on KEV0 new
BX9.8
Blink Xt2 Sync Module Firmware
Amazon
7 CVEs0 on KEV0 new
AA9.8
Amazon Athena ODBC driver
Amazon
6 CVEs0 on KEV0 new
AO9.8
Athena Odbc
Amazon
6 CVEs0 on KEV0 new
AS9.8
Aws Software Development Kit
Amazon
6 CVEs0 on KEV0 new
DA6.3
Data.all
Amazon
5 CVEs0 on KEV0 new
FI9.8
Firecracker
Amazon
5 CVEs0 on KEV0 new
KI8.8
Kiro IDE
Amazon
5 CVEs0 on KEV0 new
PA6.1
Payfort-php-sdk
Amazon
5 CVEs0 on KEV0 new
AW8.8
Amazon Web Services Internet OF Things Device Software Development Kit V2
Amazon
4 CVEs0 on KEV0 new
AC8.8
Aws Cloud Development Kit
Amazon
4 CVEs0 on KEV0 new
AW8.8
Amazon Web Services Aws-c-io
Amazon
3 CVEs0 on KEV0 new
AW7.5
Aws-lc-sys
Amazon
3 CVEs0 on KEV0 new
AL7.5
Aws Libcrypto
Amazon
3 CVEs0 on KEV0 new
ED9.8
Echo Dot Firmware
Amazon
3 CVEs0 on KEV0 new
RA8.8
Research And Engineering Studio
Amazon
3 CVEs0 on KEV0 new
TU6.5
Tuftool
Amazon
3 CVEs0 on KEV0 new
WO8.8
Workspaces
Amazon
3 CVEs0 on KEV0 new
AJ8.8
Advanced Jdbc Wrapper
Amazon
2 CVEs0 on KEV0 new
AR8.1
Amazon Redshift JDBC Driver
Amazon
2 CVEs0 on KEV0 new
AM8.8
amazon-ssm-agent
amazon
2 CVEs0 on KEV0 new
AW8.1
Amazon Web Services Redshift Java Database Connectivity Driver
Amazon
2 CVEs0 on KEV0 new
AU7.8
Audible
Amazon
2 CVEs0 on KEV0 new
AC7.0
Aws Client Vpn
Amazon
2 CVEs0 on KEV0 new
AC6.8
Aws Command Line Interface
Amazon
2 CVEs0 on KEV0 new
AE8.1
Aws Encryption Sdk
Amazon
2 CVEs0 on KEV0 new
AS5.6
Aws S3 Crypto Sdk
Amazon
2 CVEs0 on KEV0 new
AS9.0
Awslabs Sandbox Accounts For Events
Amazon
2 CVEs0 on KEV0 new
KF8.6
Kindle Firmware
Amazon
2 CVEs0 on KEV0 new
KF7.3
Kindle For PC
Amazon
2 CVEs0 on KEV0 new
KT–
Kindle Touch
Amazon
2 CVEs0 on KEV0 new
KC7.8
Kiro CLI
Amazon
2 CVEs0 on KEV0 new
LO8.8
Log4jhotpatch
Amazon
2 CVEs0 on KEV0 new
OD7.4
Opensearch Data Prepper
Amazon
2 CVEs0 on KEV0 new
OS5.9
Opensearch Security
Amazon
2 CVEs0 on KEV0 new
ST8.1
strands-agents-tools
Amazon
2 CVEs0 on KEV0 new
AL7.6
Alexa
Amazon
1 CVEs0 on KEV0 new
AC9.8
Amazon Cloudfront
Amazon
1 CVEs0 on KEV0 new
AM8.1
amazon-connect-salesforce-lambda
Amazon
1 CVEs0 on KEV0 new
AE7.2
Amazon Ecs Container Agent
Amazon
1 CVEs0 on KEV0 new
AK6.5
Amazon Key Firmware
Amazon
1 CVEs0 on KEV0 new
AM8.8
Amazon Music
Amazon
1 CVEs0 on KEV0 new
AO8.8
Amazon OpenSearch Service
Amazon
1 CVEs0 on KEV0 new
AR8.0
Amazon Redshift ODBC Driver
Amazon
1 CVEs0 on KEV0 new
AR8.0
Amazon Redshift Python Connector
Amazon
1 CVEs0 on KEV0 new
AW7.8
Amazon Web Services Cloudformation Bootstrap
Amazon
1 CVEs0 on KEV0 new
AC8.8
Amplify Codegen UI
Amazon
1 CVEs0 on KEV0 new
AL9.8
Application Load Balancer
Amazon
1 CVEs0 on KEV0 new
AM4.3
Aurora MySQL
Amazon
1 CVEs0 on KEV0 new
AA9.8
Aws Amplify Cli
Amazon
1 CVEs0 on KEV0 new
AA5.5
Aws Api Mcp Server
Amazon
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112380 | KC Kiro Crew Amazon | 9.9 | Oct 20 | Missing authorization in the WhatsApp channel in Kiro Crew |
| CVE-2026-110310 | AM Amazon.Extensions.S3.Encryption Amazon | 5.3 | Oct 14 | RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET |
| CVE-2026-104020 | IO ion-python Amazon | 7.5 | Oct 1 | Uncontrolled recursion in the Ion reader in Amazon Ion Python |
| CVE-2026-95985 | KI Kiro IDE Amazon | 8.8 | Sep 24 | Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces |
| CVE-2026-94384 | AM amazon-connect-salesforce-lambda Amazon | 8.1 | Sep 22 | Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda |
| CVE-2023-32803 | CA ca-certificates Amazon | 7.5 | Sep 14 | The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store |
| CVE-2026-89332 | KI Kiro Ide Amazon | 5.5 | Sep 11 | Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration |
| CVE-2026-18061 | AJ Advanced Jdbc Wrapper Amazon | 5.9 | Sep 11 | Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin |
| CVE-2026-85228 | DJ Deep Java Library Amazon | 9.1 | Sep 10 | Integer overflow in tensor buffer validation in Deep Java Library |
| CVE-2026-85787 | PO postgres-mcp-server Amazon | 6.5 | Sep 4 | An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server |
| CVE-2026-85786 | IO ion-java Amazon | 7.5 | Sep 4 | Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java |
| CVE-2026-85656 | LO log4j-cve-2021-44228-hotpatch Amazon | 7.8 | Sep 4 | OS command injection in Amazon log4j-cve-2021-44228-hotpatch |
| CVE-2026-85654 | AW awslabs.dynamodb-mcp-server Amazon | 7.8 | Sep 4 | Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server |
| CVE-2026-84851 | IO ion-c Amazon | 7.5 | Sep 2 | Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 |
| CVE-2026-83497 | AO Amazon OpenSearch Service Amazon | 8.8 | Aug 31 | Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination |
| CVE-2026-81849 | AM amazon-ssm-agent amazon | 8.8 | Aug 28 | Path traversal in the aws:downloadContent plugin in amazon-ssm-agent |
| CVE-2026-81838 | DI Diagram-as-code Amazon | 7.1 | Aug 27 | Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac) |
| CVE-2026-78379 | ST strands-agents-tools Amazon | 8.1 | Aug 25 | Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools |
| CVE-2026-77237 | FR Freertos Amazon | 8.4 | Aug 21 | Missing type validation in xQueueAddToSet in FreeRTOS-Kernel |
| CVE-2026-77236 | FR Freertos Amazon | 7.3 | Aug 21 | Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel |
| CVE-2026-77235 | FR Freertos Amazon | 7.3 | Aug 21 | Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel |
| CVE-2026-77234 | FR Freertos Amazon | 8.8 | Aug 21 | Improper input validation in FreeRTOS-Kernel timer command handling |
| CVE-2026-19643 | AS Aws Software Development Kit Amazon | 5.3 | Aug 12 | Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms |
| CVE-2026-19642 | AS Aws Software Development Kit Amazon | 5.9 | Aug 12 | Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp |
| CVE-2026-18954 | DM Documentdb Mcp Server Amazon | 5.5 | Aug 5 | Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server |
| CVE-2026-18953 | AT Aws Transform Mcp Server Amazon | 8.8 | Aug 5 | Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server |
| CVE-2026-18657 | KC Kiro CLI Amazon | 7.8 | Aug 4 | Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows |
| CVE-2026-18656 | KI Kiro IDE Amazon | 7.8 | Aug 4 | Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows |
| CVE-2026-18654 | AC Aws Command Line Interface Amazon | 6.8 | Aug 3 | Disabled SSH host key verification in Amazon AWS CLI EMR helper commands |
| CVE-2026-18140 | AW Aws-smithy-json Amazon | 7.5 | Jul 30 | Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers |
| CVE-2026-18245 | AC Amplify Codegen UI Amazon | 8.8 | Jul 30 | Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react |
| CVE-2026-16318 | S2 s2n-tls Amazon | 5.3 | Jul 21 | QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls |
| CVE-2026-15746 | ST strands-agents-tools Amazon | 6.5 | Jul 15 | Credential disclosure in Strands Agents Tools elasticsearch_memory tool |
| CVE-2026-15738 | AW aws-load-balancer-controller Amazon | 8.5 | Jul 14 | Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller |
| CVE-2026-14265 | AJ Advanced Jdbc Wrapper Amazon | 8.8 | Jul 1 | RCE via Deserialization in AWS Advanced JDBC Wrapper |
| CVE-2026-13769 | AC Aws Command Line Interface Amazon | 5.5 | Jul 1 | Overly permissive File Permissions in AWS CLI |
| CVE-2026-13763 | AL Application Load Balancer Amazon | 9.8 | Jun 29 | HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF |
| CVE-2026-13762 | CL Cloudfront Amazon | 9.8 | Jun 29 | HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF |
| CVE-2026-10591 | KI Kiro Ide Amazon | 8.8 | Jun 2 | Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths |
| CVE-2026-9255 | KC Kiro Cli Amazon | 7.8 | May 22 | Tool Execution Without Authorization via Piped Stdin in Kiro CLI |
| CVE-2026-8178 | AR Amazon Redshift JDBC Driver Amazon | 8.1 | May 8 | Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver |
| CVE-2026-7791 | WO Workspaces Amazon | 7.8 | May 4 | Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent |
| CVE-2026-7461 | AE Amazon Ecs Container Agent Amazon | 7.2 | Apr 30 | OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials |
| CVE-2026-7426 | FR Freertos-plus-tcp Amazon | 8.1 | Apr 29 | Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP |
| CVE-2026-7425 | FR Freertos-plus-tcp Amazon | 6.5 | Apr 29 | Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP |
| CVE-2026-7424 | FR Freertos-plus-tcp Amazon | 8.1 | Apr 29 | Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP |
| CVE-2026-7423 | FR Freertos-plus-tcp Amazon | 6.5 | Apr 29 | Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP |
| CVE-2026-7422 | FR Freertos-plus-tcp Amazon | 6.5 | Apr 29 | MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing |
| CVE-2026-6968 | TO Tough Amazon | 6.5 | Apr 24 | Multiple Path Traversal Variants in awslabs/tough |
| CVE-2026-6967 | TO Tough Amazon | 6.5 | Apr 24 | Missing Delegated Metadata Validation in awslabs/tough |
| CVE-2026-6966 | TO Tough Amazon | 6.5 | Apr 24 | Signature Threshold Bypass in awslabs/tough Delegated Roles |
| CVE-2026-31431 In wildKEV | AL Amazon Linux Amazon | 7.8 | Apr 22 | crypto: algif_aead - Revert to operating out-of-place |
| CVE-2026-6437 | AE AWS EFS CSI Driver Amazon | 6.5 | Apr 17 | AWS EFS CSI Driver Mount Option Injection |
| CVE-2026-5747 | FI Firecracker Amazon | 7.5 | Apr 7 | Out-of-bounds Write in Firecracker virtio-pci Transport |
| CVE-2026-5709 | RA Research And Engineering Studio Amazon | 8.8 | Apr 6 | AWS Research and Engineering Studio (RES) FileBrowser Command Injection |
| CVE-2026-5708 | RA Research And Engineering Studio Amazon | 8.8 | Apr 6 | Improper Control of User-Modifiable Attributes in RES CreateSession API |
| CVE-2026-5707 | RA Research And Engineering Studio Amazon | 8.8 | Apr 6 | Command Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES) |
| CVE-2026-35558 | AA Amazon Athena ODBC driver Amazon | 7.8 | Apr 3 | Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver |
| CVE-2026-35559 | AA Amazon Athena ODBC driver Amazon | 6.5 | Apr 3 | Out-of-bounds write in query processing components in Amazon Athena ODBC driver |
| CVE-2026-5485 | AA Amazon Athena ODBC driver Amazon | 7.8 | Apr 3 | OS command injection in Amazon Athena ODBC driver on Linux |