Amazon

16 CVEs published in the last four months and 2 stories. Exploited flaws first.

Critical3

High12

Medium1

Exploited (KEV)0

All recent CVEs

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-13763	9.8	critical	application load balancer	Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow r	68d ago
CVE-2026-13762	9.8	critical	cloudfront	Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors	68d ago
CVE-2026-18245	9	critical	amplify codegen ui	Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote aut	37d ago
CVE-2026-77234	8.8	high	freertos	Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports t	15d ago
CVE-2026-10591	8.8	high	kiro ide	Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow	95d ago
CVE-2026-18953	8.6	high	aws transform mcp server	Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transfo	31d ago
CVE-2026-9255	7.8	high	kiro cli	Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker	106d ago
CVE-2026-18656	7.8	high	kiro ide	An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthentic	32d ago
CVE-2026-18657	7.8	high	kiro cli	An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthentica	32d ago
CVE-2026-14265	7.5	high	advanced jdbc wrapper	Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3	66d ago
CVE-2026-18140	7.5	high	aws-smithy-json	Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the	37d ago
CVE-2026-4269	7.5	high	bedrock agentcore starter toolkit	A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a rem	173d ago
CVE-2026-77235	7.3	high	freertos	Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow	15d ago
CVE-2026-77236	7.3	high	freertos	Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local us	15d ago
CVE-2026-81838	7.1	high	diagram-as-code	A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.	9d ago
CVE-2026-4270	5.5	medium	aws api mcp server	Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server version	173d ago

Filter the full tracker by Amazon →

Our coverage of Amazon

Twitch wants your content for Amazon AI training. Here’s how to opt out

Twitch added an option to opt out of training Amazon AI with your content—two years after it confirmed that training had begun.

vulnerabilityJun 29, 2026

Amazon Q VS Extension Flaw Leads to Cloud Credential Theft

Adversaries could plant a malicious repository that can execute arbitrary code and steal cloud credentials by exploiting the vulnerability, which showcases growing MCP risk.