Amazon

16 CVEs published in the last four months and 3 stories. Exploited flaws first.

Critical3

High12

Medium1

Exploited (KEV)0

All recent CVEs

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-13763	9.8	critical	application load balancer	Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow r	115d ago
CVE-2026-13762	9.8	critical	cloudfront	Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors	115d ago
CVE-2026-18245	9	critical	amplify codegen ui	Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote aut	84d ago
CVE-2026-77234	8.8	high	freertos	Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports t	62d ago
CVE-2026-10591	8.8	high	kiro ide	Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow	142d ago
CVE-2026-18953	8.6	high	aws transform mcp server	Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transfo	78d ago
CVE-2026-9255	7.8	high	kiro cli	Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker	153d ago
CVE-2026-18656	7.8	high	kiro ide	An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthentic	79d ago
CVE-2026-18657	7.8	high	kiro cli	An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthentica	79d ago
CVE-2026-14265	7.5	high	advanced jdbc wrapper	Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3	113d ago
CVE-2026-18140	7.5	high	aws-smithy-json	Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the	84d ago
CVE-2026-4269	7.5	high	bedrock agentcore starter toolkit	A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a rem	220d ago
CVE-2026-77235	7.3	high	freertos	Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow	62d ago
CVE-2026-77236	7.3	high	freertos	Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local us	62d ago
CVE-2026-81838	7.1	high	diagram-as-code	A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.	56d ago
CVE-2026-4270	5.5	medium	aws api mcp server	Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server version	220d ago

Filter the full tracker by Amazon →

Our coverage of Amazon

Kevin Mandia joins the Amazon board with 30-plus years in cybersecurity

Amazon has elected cybersecurity veteran Kevin Mandia to its Board of Directors, a move announced on September 8. Mandia brings over 30 years of experience in combating cyber threats across both public and private sectors, with Amazon citing cybersecurity as a critical risk and responsibility, particularly in light of evolving AI-driven threats.

Twitch wants your content for Amazon AI training. Here’s how to opt out

Twitch, the Amazon-owned livestreaming platform, has confirmed that content from its users' channels is being utilized to train Amazon's generative artificial intelligence models. This practice, which has been ongoing for over two years, recently gained attention following the introduction of an opt-out setting, which is enabled by default for all users.

vulnerabilityJun 29, 2026

Amazon Q VS Extension Flaw Leads to Cloud Credential Theft

A security flaw has been discovered that could allow attackers to steal cloud credentials by planting a malicious repository. This vulnerability affects Amazon's Q, a generative AI assistant, and highlights the increasing risks associated with multi-cloud platform (MCP) environments.