Search threats, CVEs… ⌘K
Vendor advisories

AWS Security Bulletins

Browse 152 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 10 minutes ago Checked every 15 minutes
All vendor sources Official source

152 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
AWS Security BulletinsCVE-2026-105812
Severity not listed

CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF

Bulletin ID: 2026-127-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/06/2026 13:30 PM PDT Description: bedrock-agentcore-starter-toolkit is an AWS-maintained open-source Python package, distributed via GitHub and PyPI, that provides a command-...

CVE-2026-105812CVE-2026-106032
Read the vendor advisory
AWS Security BulletinsCVE-2026-104019
Severity not listed

CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution

Bulletin ID: 2026-125-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 13:00 PM PDT Description: Amazon SageMaker Unified Studio is an AWS service that unifies data, analytics, and AI development. It lets you find and access your organiz...

Vendor guidance

Impacted versions: - 2.8.x - 2.13.x: all versions affected, no fix (end of support) - 2.14.x: < 2.14.12, fixed in 2.14.12 - 3.3.x - 3.8.x: all versions affected, no fix (end of support) - 3.9.x: < 3.9.12, fixed in 3.9...

CVE-2026-104019
Read the vendor advisory
AWS Security BulletinsCVE-2026-103956
Severity not listed

CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS

Bulletin ID: 2026-124-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 12:00 PM PDT Description: Loom is an AWS Labs open-source AI agent orchestration platform. We have identified and addressed three issues in Loom for AWS, described be...

Vendor guidance

We recommend upgrading to the latest version (1.7.0) and ensuring any forked or derivative code is patched to incorporate the new fixes.

CVE-2026-103956CVE-2026-103957CVE-2026-103958
Read the vendor advisory
AWS Security BulletinsCVE-2026-104002
Severity not listed

CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

Bulletin ID: 2026-123-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 14:00 PM PDT Description: Powertools for AWS Lambda (Python) is a developer toolkit that implements serverless best practices and increases developer velocity. We ide...

CVE-2026-104002
Read the vendor advisory
AWS Security BulletinsCVE-2026-95985
Severity not listed

CVE-2026-95985 - Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces

Bulletin ID: 2026-117-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/24/2026 10:00 AM PDT Description: Kiro is an agentic IDE that users install on their desktop. We identified CVE-2026-95985. The file write tool in Kiro IDE before version 1.0...

CVE-2026-95985
Read the vendor advisory
AWS Security BulletinsCVE-2026-94450
Severity not listed

CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

Bulletin ID: 2026-116-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/22/2026 13:00 PM PDT Description: s2n-quic is a Rust implementation of the QUIC protocol. We identified CVE-2026-94450, an issue with improper validation of the Destination C...

CVE-2026-94450
Read the vendor advisory
AWS Security BulletinsCVE-2026-92943
Severity not listed

CVE-2026-92943 - Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Bulletin ID: 2026-115-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/17/2026 12:00 PM PDT Description: AWS IoT Device SDK for Python (AWSIoTPythonSDK) is an open source SDK that lets IoT devices and gateways connect to AWS IoT Core over MQTT. ...

CVE-2026-92943
Read the vendor advisory
AWS Security BulletinsCVE-2026-86831
Severity not listed

CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

Bulletin ID: 2026-113-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/16/2026 12:30 PM PDT Description: Network Policy Agent is an EKS Policy management feature. We identified CVE-2026-86831, a cross-namespace NetworkPolicy bypass in Amazon EKS...

CVE-2026-86831
Read the vendor advisory
AWS Security BulletinsCVE-2026-86830
Severity not listed

CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

Bulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT Description: Temporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identit...

CVE-2026-86830
Read the vendor advisory
AWS Security BulletinsCVE-2026-89332
Severity not listed

CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

Bulletin ID: 2026-111-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 12:00 PM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. W...

CVE-2026-89332
Read the vendor advisory
AWS Security BulletinsCVE-2026-3336
Severity not listed

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Bulletin ID: 2026-005-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/02 14:30 PM PST Description: AWS-LC is an open-source, general-purpose cryptographic library. We identified three distinct issues: - CVE-2026-3336: PKCS7_verify Certific...

CVE-2026-3336CVE-2026-3337CVE-2026-3338
Read the vendor advisory
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources