A
Vendor security profile
AWS
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs56
Critical5
CISA KEV0
Public exploit0
Patch rate%96
Avg. CVSS7.4
12-month vulnerability rate
0
0
0
0
2
0
0
0
2
18
18
16
CVE KEV
CVE severity distribution
56toplam CVE
Critical5 (9%)
High29 (52%)
Medium22 (39%)
Patch and exploitation view
%96
Verified patch
%0
CISA KEV
%0
Public exploit
54Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
2.3
CVE-2026-108839
thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs
T
Patch status unknown
6.4
CVE-2026-18558
Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
A
Patch status unknownEPSS %0
6.5
CVE-2026-108096
Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
A
Patch verifiedEPSS %0
5.9
CVE-2026-107783
Insertion of sensitive information into log file in AWS Tools for PowerShell
A
Patch verifiedEPSS %0
6.8
CVE-2026-107608
Improper link resolution in asset bundling output handling in aws-cdk-lib
A
Patch verifiedEPSS %0
8.5
CVE-2026-107322
OS command injection in Amazon Agent Plugins for AWS databases-on-aws
A
Patch verifiedEPSS %0
6.8
CVE-2026-107332
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
A
Patch verifiedEPSS %0
7.7
CVE-2026-107352
Missing authorization checks in Amazon Athena engine version 3 request handling
A
Patch status unknownEPSS %0
5.7
CVE-2026-106032
Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import
A
Patch verifiedEPSS %0
8.8
CVE-2026-105812
Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
A
Patch verifiedEPSS %0