AWS security advisories
16 threat alerts tracking vulnerabilities and security advisories that affect AWS products.
Vulnios monitors AWS CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent AWS security news in one place, or click into an individual alert for full detail.
CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Bulletin ID: 2026-163-AWS Publication Date: 11/02/2026 11:00 AM PST Description: aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-workflows repository, t
criticalCVE-2026-120497CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in
criticalCVE-2026-116635Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
The Hacker News published an news on "Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers". Topic areas: zero-day, malware, ransomware, data-breach. Published November 2, 2
criticalCVE-2026-119085 - Template injection in the publishing component of Virtual Engineering Workbench
Bulletin ID: 2026-162-AWS Publication Date: 11/02/2026 09:30 AM PST Description: Virtual Engineering Workbench (VEW) is an open-source platform where platform engineers define and publish development
criticalCVE-2026-119085ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The Hacker News published an news on "ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws". Topic areas: zero-day, malware, ransomware, data-breach. Published October
criticalThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
The Hacker News published an news on "ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories". Topic areas: zero-day, malware, ransomware, data-brea
criticalCVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C
Bulletin ID: 2026-157-AWS Publication Date: 10/30/2026 09:00 AM PDT Description: We identified CVE-2026-119116, a use-after-free in the SetClient command handler of the kmstool-enclave example applica
criticalCVE-2026-119116CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel
Bulletin ID: 2026-158-AWS Publication Date: 10/30/2026 10:30 AM PDT Description: FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by A
criticalCVE-2026-119086CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
Bulletin ID: 2026-159-AWS Publication Date: 10/30/2026 11:00 AM PDT Description: We published CVE-2026-119117. Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for
criticalCVE-2026-119117CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools
Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language
criticalCVE-2026-115415CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas
Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python libra
criticalCVE-2026-118029CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could allow a third party to
criticalCVE-2026-111497CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)
Bulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT Description: The AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha
criticalCVE-2026-115418CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles
Bulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT Summary: AWS identified CVE-2026-111943, a key-generation flaw at external C
criticalCVE-2026-111943CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server
Bulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT Description: AWS MCP Server is a managed server that gives AI agents access
criticalCVE-2026-115845CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server
Bulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT Description: Amazon Web Services Multi Model Server (MMS) is an open source
criticalCVE-2026-115812
Track AWS exposure across your environment
Vulnios automatically cross-references your asset inventory against new AWS CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan