CVEs we hold for Amazon

Records whose assigning authority named Amazon as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-95985Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted WorkspacesAmazon Kiro IDE

CVE-2026-94384Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambdaamazon-connect-salesforce-lambda

CVE-2026-8597Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDKAmazon SageMaker Python SDK AWS

CVE-2026-8596Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve pathAmazon SageMaker Python SDK AWS

CVE-2026-85787An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-serverAmazon postgres-mcp-server

CVE-2026-85786Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-javaAmazon ion-java

CVE-2026-85656OS command injection in Amazon log4j-cve-2021-44228-hotpatchAmazon log4j-cve-2021-44228-hotpatch

CVE-2026-85654Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverAmazon awslabs.dynamodb-mcp-server

CVE-2026-85228Integer overflow in tensor buffer validation in Deep Java LibraryAmazon Deep Java Library

CVE-2026-84851Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6Amazon ion-c

CVE-2026-81849Path traversal in the aws:downloadContent plugin in amazon-ssm-agentamazon-ssm-agent

CVE-2026-8178Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC DriverAmazon Redshift JDBC Driver

CVE-2026-78379Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents ToolsAmazon strands-agents-tools

CVE-2026-7791no title heldAmazon Workspaces

CVE-2026-75936Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-javaAmazon Ion Java

CVE-2026-75935Memory-amplification denial of service via declared-length preallocation in Amazon ion-javaAmazon Ion Java

CVE-2026-6437AWS EFS CSI Driver Mount Option InjectionAmazon AWS EFS CSI Driver

CVE-2026-5485OS command injection in Amazon Athena ODBC driver on LinuxAmazon Athena ODBC driver

CVE-2026-35562Allocation of resources without limits in parsing components in Amazon Athena ODBC driverAmazon Athena ODBC driver

CVE-2026-35561Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driverAmazon Athena ODBC driver

CVE-2026-35560Improper certificate validation in identity provider connection components in Amazon Athena ODBC driverAmazon Athena ODBC driver

CVE-2026-35559Out-of-bounds write in query processing components in Amazon Athena ODBC driverAmazon Athena ODBC driver

CVE-2026-35558Improper neutralization of special elements in authentication components in Amazon Athena ODBC driverAmazon Athena ODBC driver

CVE-2026-18657Executable Resolution from Untrusted Project Directory in Kiro CLI on WindowsAmazon Kiro CLI

CVE-2026-18656Executable Resolution from Untrusted Project Directory in Kiro IDE on WindowsAmazon Kiro IDE

CVE-2026-16318QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tlsAmazon s2n-tls

CVE-2026-15746Credential disclosure in Strands Agents Tools elasticsearch_memory toolAmazon strands-agents-tools

CVE-2026-15738Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer ControllerAmazon aws-load-balancer-controller

CVE-2026-12958Arbitrary file write in Language Servers for AWSAmazon Web Services Language Servers for AWS

CVE-2026-12957Arbitrary Code Execution in Language Servers for AWSAmazon Web Services Language Servers for AWS

CVE-2026-110310RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NETAmazon Amazon.Extensions.S3.Encryption

CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion PythonAmazon ion-python

CVE-2025-9039Information Disclosure in Amazon ECS Container AgentAmazon ECS

CVE-2025-8904Privilege escalation issue in Amazon EMR Secret Agent componentAmazon EMR

CVE-2025-8217Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) ExtensionAmazon Q Developer VS Code Extension

CVE-2025-6031Insecure device pairing in end of life Amazon Cloud CamAmazon Cloud Cam

CVE-2025-5688Out of Bounds Write in FreeRTOS-Plus-TCPAmazon FreeRTOS

CVE-2025-5279Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider pluginAmazon Redshift

CVE-2025-4318Input validation issue in AWS Amplify Studio UI component propertiesAmazon Amplify Studio

CVE-2025-3857Infinite loop condition in Amazon.IonDotnetAmazon Ion Dotnet

CVE-2025-12829no title heldAmazon Ion-C

CVE-2025-12779no title heldAmazon WorkSpaces

CVE-2025-11573Denial of Service issue in Amazon.IonDotnetAmazon Amazon.IonDotnet

CVE-2025-0501Issue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)Amazon WorkSpaces Client

CVE-2025-0500Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clientsAmazon DCV Client

CVE-2024-8901Lack of JWT issuer and signer validationAmazon AWS ALB Route Directive Adapter For Istio

CVE-2024-52314data.all admin user may access potentially sensitive data stored by producers via logsamazon data.all

CVE-2024-52313data.all authenticated users can obtain incorrect object level authorizationsamazon data.all

CVE-2024-52312data.all authenticated users can perform restricted operations against DataSets and Environmentsamazon data.all

CVE-2024-52311data.all does not invalidate authentication token upon user logoutamazon data.all

CVE-2024-21634Ion Java StackOverflow vulnerabilityamazon-ion ion-java

CVE-2024-12746SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0Amazon Redshift ODBC Driver

CVE-2024-12745SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4Amazon Redshift Python Connector

CVE-2024-12744SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31Amazon Redshift JDBC Driver

CVE-2024-10953data.all authenticated users can perform mutating update operations on persisted notification recordsamazon data.all

CVE-2024-10125Lack of JWT issuer and signer validationAmazon Amazon.ApplicationLoadBalancer.Identity.AspNetCore…

CVE-2023-32803no title heldAmazon ca-certificates

CVE-2023-1385no title heldAmazon Fire TV Stick 3rd gen; Insignia TV with FireOS

CVE-2023-1384no title heldAmazon Fire TV Stick 3rd gen; Insignia TV with FireOS

CVE-2023-1383no title heldAmazonFire TV Stick 3rd gen Fire TV Stick 3rd gen…

CVE-2023-0075Amazon JS <= 0.10 - Contributor+ Stored XSSUnknown Amazon JS

CVE-2022-1830Amazon Einzeltitellinks <= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRFUnknown Amazon Einzeltitellinks

CVE-2022-1645Amazon Link <= 3.2.10 - Admin+ Stored Cross-Site ScriptingUnknown Amazon Link

CVE-2022-0071Hotdog Container EscapeAmazon Web Services Hotdog

CVE-2022-0070Log4j hot patch package privilege escalationAmazon Web Services log4j-cve-2021-44228-hotpatch

CVE-2021-40831Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devicesAmazon Web Services AWS-C-IO

CVE-2021-40830Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systemsAmazon Web Services AWS-C-IO

CVE-2021-40829TLS hostname validation issues within AWS IoT Device SDKs on macOSAmazon Web Services AWS-C-IO

CVE-2021-40828TLS hostname validation issues within AWS IoT Device SDKs on WindowsAmazon Web Services AWS-C-IO

CVE-2021-3101Hotdog Container EscapeAmazon Web Services Hotdog

CVE-2021-3100Log4j hot patch package privilege escalationAmazon Web Services log4j-cve-2021-44228-hotpatch

CVE-2021-30355no title heldn/a Amazon Kindle e-reader

CVE-2021-30354no title heldn/a Amazon Kindle e-reader

CVE-2020-8897Robustness weakness in AWS KMS and Encryption SDKsAmazon AWS SDK

CVE-2019-3989no title heldn/a Amazon's Blink XT2 Sync Module

CVE-2019-3988no title heldn/a Amazon's Blink XT2 Sync Module

CVE-2019-3987no title heldn/a Amazon's Blink XT2 Sync Module

CVE-2019-3986no title heldn/a Amazon's Blink XT2 Sync Module

CVE-2019-3985no title heldn/a Amazon's Blink XT2 Sync Module

CVE-2019-3984no title heldAmazon Blink XT2 Sync Module firmware

CVE-2019-3983no title heldn/a Amazon's Blink XT2 Sync Module

CVE-2018-1169no title heldAmazon Music Player

CVE-2015-7292no title heldn/a Amazon Fire OS before 2016-01-15

83 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.