CVE-2026-18061Medium· 5.9▾ SunlitImproper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files f…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value.
To remediate this issue, users should upgrade to version 4.3.0 or later.
advanced_jdbc_wrapper >= 3.3.0, < 4.3.0Upgrade past the affected range:
advanced_jdbc_wrapper 4.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115415Medium· 6.5Secret masking bypass in the environment tool in Strands Agents Tools
CVE-2026-112380Critical· 9.9Missing authorization in the WhatsApp channel in Kiro Crew
CVE-2026-35559Medium· 6.5Out-of-bounds write in query processing components in Amazon Athena ODBC driver
CVE-2026-8178High· 8.1Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
CVE-2026-35561High· 7.4Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver
CVE-2026-35558High· 7.8Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver