Amazon has 36 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 14 in the last 90 days against 3 in the 90 before. The busiest recent month was April 2026 with 11. The median CVSS is 7.4 (high), with 2 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (4) and CWE-78 (3). Most affected products: Amazon Athena ODBC driver (5), freertos (4), freertos-plus-tcp (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.4
- Publish → KEV
- —
- Last 90 days
- 14 prev 3
Products
- Amazon Athena ODBC driver 5
- freertos 4
- freertos-plus-tcp 3
- research_and_engineering_studio 3
- com.amazon.jenkins.fleet:ec2-fleet 2
- AWS EFS CSI Driver 1
Worst active — by depth score
CVE-2026-112380Critical· 9.9Missing authorization in the WhatsApp channel in Kiro Crew55CVE-2026-7791High· 7.8Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent55CVE-2024-28056Critical· 9.8Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects54CVE-2026-5709High· 8.8Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via craft…49CVE-2026-5708High· 8.8Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual…49
Amazon vulnerabilities
CVEs affecting Amazon, newest first. Open any entry for full detail, references, and exploit status.
36 CVEsRSS
CVE-2025-62371High· 7.4OpenSearch Data Prepper as an open source data collector for observability data
OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provid…
CVE-2025-11618Medium· 4.3A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. This issue only affect…
A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. This issue only affect…
CVE-2025-11617Medium· 5.4A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using …
A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using …
CVE-2025-11616Medium· 5.4A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect a…
A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect a…
CVE-2024-28056Critical· 9.8Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects
Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "…
CVE-2024-23680Medium· 5.3AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.