CVE-2026-119084High· 8.1▾ TwilightUnsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.
To remediate this issue, users should upgrade to version 2.3.0 or later.
amazon-redshift-jdbc-driver < 2.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100308High· 7.8Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a craf…
CVE-2026-119922High· 8.8Babelfish for PostgreSQL Privilege Escalation
CVE-2026-121652Medium· 5.4Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
CVE-2026-119085High· 8.8Template injection in the publishing component of awslabs Virtual Engineering Workbench
CVE-2026-116635Medium· 6.1Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
CVE-2026-120497Medium· 5.0Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows