Vendor advisories

AWS Security Bulletins

Browse 152 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 minutes ago Checked every 15 minutes

152 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results

AWS Security BulletinsCVE-2026-18654

Published Oct 21, 2026

Severity not listed

CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-18654

Read the vendor advisory

AWS Security BulletinsCVE-2026-19311

Published Oct 21, 2026

Severity not listed

CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin

Open the original vendor bulletin for the full description and affected-version details.

Vendor guidance

Impacted versions: OpenSearch Alerting Plugin (open-source, self-managed): - Affected: 2.4.0 through 2.19.5, 3.0.0 through 3.7.0 - Fixed: 2.19.6, 3.8.0 Amazon OpenSearch Service (AWS Managed): - Affected: All domains ...

CVE-2026-19311

Read the vendor advisory

AWS Security BulletinsCVE-2026-18954

Published Oct 21, 2026

Severity not listed

CVE-2026-18954 - Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-18954

Read the vendor advisory

AWS Security BulletinsCVE-2026-112407

Published Oct 20, 2026

Severity not listed

CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications

Bulletin ID: 2026-141-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:30 PM PDT Description: CICD-toolchain-for-serverless-applications is an AWS sample application that provisions a CI/CD pipeline for serverless applications through...

CVE-2026-112407

Read the vendor advisory

AWS Security BulletinsCVE-2026-112380

Published Oct 20, 2026

Severity not listed

CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew

Bulletin ID: 2026-140-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:00 PM PDT Description: Kiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI, or messaging channels such as WhatsApp, and t...

CVE-2026-112380

Read the vendor advisory

AWS Security BulletinsCVE-2026-18394

Published Oct 19, 2026

Severity not listed

CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-18394

Read the vendor advisory

AWS Security BulletinsCVE-2026-16317

Published Oct 19, 2026

Severity not listed

CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-16317 CVE-2026-16318

Read the vendor advisory

AWS Security BulletinsCVE-2026-15415

Published Oct 19, 2026

Severity not listed

CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-15415

Read the vendor advisory

AWS Security BulletinsCVE-2026-16584

Published Oct 19, 2026

Severity not listed

CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Failure

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-16584

Read the vendor advisory

AWS Security BulletinsCVE-2026-15737

Published Oct 19, 2026

Severity not listed

CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-15737

Read the vendor advisory

AWS Security BulletinsCVE-2026-12283

Published Oct 19, 2026

Severity not listed

CVE-2026-12283 - Issue with Athena Federated Query Synapse Connector

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-12283

Read the vendor advisory

AWS Security BulletinsCVE-2026-16796

Published Oct 19, 2026

Severity not listed

CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-16796

Read the vendor advisory

AWS Security BulletinsCVE-2026-15746

Published Oct 19, 2026

Severity not listed

CVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory tool

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-15746

Read the vendor advisory

AWS Security BulletinsCVE-2026-16756

Published Oct 19, 2026

Severity not listed

CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-16756

Read the vendor advisory

AWS Security BulletinsCVE-2026-15895

Published Oct 19, 2026

Severity not listed

CVE-2026-15895: OS command injection in jsii-diff in AWS jsii

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-15895

Read the vendor advisory

AWS Security BulletinsCVE-2026-18140

Published Oct 19, 2026

Severity not listed

CVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-18140

Read the vendor advisory

AWS Security BulletinsCVE-2025-4318

Published Oct 19, 2026

Severity not listed

Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Open the original vendor bulletin for the full description and affected-version details.

CVE-2025-4318

Read the vendor advisory

AWS Security BulletinsCVE-2026-15643

Published Oct 19, 2026

Severity not listed

CVE-2026-15643 - AWS HealthLake MCP Server SSRF via Unvalidated Pagination URL

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-15643

Read the vendor advisory

AWS Security BulletinsCVE-2026-50195

Published Oct 19, 2026

Severity not listed

Issue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-50195 CVE-2026-53488 CVE-2026-53492 CVE-2026-53489 CVE-2026-47262

Read the vendor advisory

AWS Security BulletinsCVE-2026-12957

Published Oct 19, 2026

Severity not listed

CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins

Open the original vendor bulletin for the full description and affected-version details.

Vendor guidance

Both issues are remediated in Language Servers for AWS version 1.69.0.

CVE-2026-12957 CVE-2026-12958

Read the vendor advisory

AWS Security BulletinsCVE-2026-13762

Published Oct 19, 2026

Severity not listed

CVE-2026-13762 and CVE-2026-13763 - Issue with HTTP/2 multi-frame request body inspection in AWS WAF

Open the original vendor bulletin for the full description and affected-version details.

Vendor guidance

This issue was remediated server-side; no customer action is required.

CVE-2026-13762 CVE-2026-13763

Read the vendor advisory

AWS Security BulletinsCVE-2026-10740

Published Oct 19, 2026

Severity not listed

CVE-2026-10740 - Excessive memory allocation in s2n-quic

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-10740

Read the vendor advisory

AWS Security BulletinsCVE-2026-14471

Published Oct 19, 2026

Severity not listed

CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-14471

Read the vendor advisory

AWS Security BulletinsCVE-2026-14265

Published Oct 19, 2026

Severity not listed

CVE-2026-14265- Deserialization of Untrusted Data in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Open the original vendor bulletin for the full description and affected-version details.

CVE-2026-14265

Read the vendor advisory

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources