AWS security advisories
13 threat alerts tracking vulnerabilities and security advisories that affect AWS products.
Vulnios monitors AWS CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent AWS security news in one place, or click into an individual alert for full detail.
CVE-2026-119084 - Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
Bulletin ID: 2026-168-AWS Publication Date: 11/03/2026 13:00 PM PST Description: We identified CVE-2026-119084, an issue in Amazon Redshift JDBC Driver versions prior to 2.3.0. Under certain condition
criticalCVE-2026-119084CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation
Bulletin ID: 2026-165-AWS Publication Date: 11/03/2026 10:00 AM PST Description: Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.
criticalCVE-2026-119922CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass
AWS Security Bulletins published an advisory on "CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass". Topic areas: aws, cloud, patch, identity. Published November 3, 2026. See
criticalCVE-2026-115413CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Bulletin ID: 2026-167-AWS Publication Date: 11/03/2026 10:30 AM PST Description: maplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL J
criticalCVE-2026-121652CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in
criticalCVE-2026-116635CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Bulletin ID: 2026-163-AWS Publication Date: 11/02/2026 11:00 AM PST Description: aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-workflows repository, t
criticalCVE-2026-120497CVE-2026-119085 - Template injection in the publishing component of Virtual Engineering Workbench
Bulletin ID: 2026-162-AWS Publication Date: 11/02/2026 09:30 AM PST Description: Virtual Engineering Workbench (VEW) is an open-source platform where platform engineers define and publish development
criticalCVE-2026-119085CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel
Bulletin ID: 2026-158-AWS Publication Date: 10/30/2026 10:30 AM PDT Description: FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by A
criticalCVE-2026-119086CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
Bulletin ID: 2026-159-AWS Publication Date: 10/30/2026 11:00 AM PDT Description: We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for
criticalCVE-2026-119117CVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C
Bulletin ID: 2026-157-AWS Publication Date: 10/30/2026 09:00 AM PDT Description: We identified CVE-2026-119116, a use-after-free in the SetClient command handler of the kmstool-enclave example applica
criticalCVE-2026-119116CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools
Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language
criticalCVE-2026-115415CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could allow a third party to
criticalCVE-2026-111497CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas
Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python libra
criticalCVE-2026-118029
Track AWS exposure across your environment
Vulnios automatically cross-references your asset inventory against new AWS CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan