CVE Tools
Track your stack

Aws

149 CVEs tracked since 2022. Since Dec 2022, none of them reached CISA KEV.

Aws CVEs per month

Dec 2022 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Aws CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2022-1230
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-0390
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-1270
2026-015 or fewer
2026-025 or fewer
2026-0380
2026-04180
2026-057 or fewer
2026-06120
2026-07190
2026-08180
2026-09210
2026-10340
2026-110

Products

The products that kept showing up in Aws's monthly top three, with their CVEs summed over those months.

  1. Tough72 months
  2. Freertos-plus-tcp51 month
  3. Aws-lc41 month
  4. Amazon Opensearch Service31 month
  5. Loom31 month
  6. Opensearch31 month
  7. Tuftool31 month
  8. Amazon Athena21 month
  9. Aws Serverless Application Model Command Line Interface21 month
  10. Aws-lc-fips21 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Aws.

  1. CVE-2026-119924Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser8.1
  2. CVE-2026-119923Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser9.8
  3. CVE-2026-122193OS command injection in the example SSM documents in Trusted Remote Execution (REX)9.9
  4. CVE-2026-119083GluonTS arbitrary file write during archive extraction7.8
  5. CVE-2026-122266Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS8.7
  6. CVE-2026-122192Guest access to Firecracker process memory after a failed memory discard7.5
  7. CVE-2026-119084Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters8.1
  8. CVE-2026-121652Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering5.4
  9. CVE-2026-119922Babelfish for PostgreSQL Privilege Escalation8.8
  10. CVE-2026-116635Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server6.1
  11. CVE-2026-120497Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows5.0
  12. CVE-2026-119085Template injection in the publishing component of awslabs Virtual Engineering Workbench8.8
  13. CVE-2026-119301Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas7.9
  14. CVE-2026-119117Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java6.5
  15. CVE-2026-119148Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint6.5

The record

Peak rank
#50 in Apr 2026
Busiest month shown
Oct 2026, 34 CVEs
Months with a KEV entry
0 since Dec 2022
Monthly snapshots
10 since 2022
Aws's full record, month by month