AWS
Number 97 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: AWS, aws
Total vulnerabilities
195
Critical
19
High
97
Known Exploited
0
Exploit available
0
Network, no login needed
23.6%
Of 195 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 157 | 16 | 88 | 52 | 1 | 0 |
| 2025 | 27 | 1 | 4 | 21 | 1 | 0 |
| 2024 | 5 | 2 | 2 | 1 | 0 | 0 |
| 2023 | 2 | 0 | 0 | 2 | 0 | 0 |
| 2022 | 4 | 0 | 3 | 1 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| FreeRTOS-Plus-TCP | 7 | 2 |
| tough | 7 | 0 |
| Kiro IDE | 6 | 4 |
| AWS-LC | 4 | 3 |
| Research and Engineering Studio (RES) | 4 | 3 |
| AWS Advanced JDBC Wrapper | 3 | 2 |
| AWS Ops Wheel | 3 | 3 |
| Amazon OpenSearch Service | 3 | 3 |
| Amazon SageMaker Python SDK | 3 | 3 |
| SageMaker Python SDK | 3 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Command Injection | 14 | 14 |
| Memory Corruption | 11 | 7 |
| Cross-Site Scripting | 7 | 5 |
| Incorrect Authorization | 7 | 4 |
| Server-Side Request Forgery | 7 | 4 |
| Relative path traversal | 6 | 2 |
| Use of a Broken or Risky Cryptographic Algorithm | 6 | 0 |
| Code Injection | 5 | 5 |
| Insecure Deserialization | 5 | 5 |
| Path Traversal | 5 | 3 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-126087 | Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent | High | n/a | |
| CVE-2026-125271 | AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization | High | n/a | |
| CVE-2026-124034 | Path traversal in Amazon Braket SDK local hybrid job input data download | Medium | 0.5% | |
| CVE-2026-124033 | Relative path traversal in the log export commands in AWS ParallelCluster CLI | Medium | 0.4% | |
| CVE-2026-122193 | OS command injection in the example SSM documents in Trusted Remote Execution (REX) | Critical | 1.6% | |
| CVE-2026-119924 | Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser | High | 0.5% | |
| CVE-2026-119923 | Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser | Critical | 0.6% | |
| CVE-2026-119083 | GluonTS arbitrary file write during archive extraction | High | 0.2% | |
| CVE-2026-122266 | Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS | High | 0.3% | |
| CVE-2026-122192 | Guest access to Firecracker process memory after a failed memory discard | High | 0.2% |