Amazon Web Services, Inc.

152 articles in the TruthFoundry index. Each links out to the original.

• AWS Publishes Security Bulletin For Linux Kernel CVE-2026-98432 · AWS released guidance for critical Linux kernel TCP use-after-free vulnerability CVE-2026-98432.
• AWS discloses credential leak vulnerability in Kinesis Producer Library Java · CVE-2026-119117 exposes AWS credentials in KPL versions before 1.0.8.
• AWS discloses FreeRTOS kernel privilege escalation vulnerability CVE-2026-119086 · AWS published security advisory for type validation flaw in FreeRTOS-Kernel queue handling.
• AWS patches authorization flaw CVE-2026-119115 in Kubernetes Private CA Connector · AWS discloses and fixes CVE-2026-119115 authorization vulnerability in Kubernetes Private CA Connector.
• CVE-2026-118029 vulnerability patched in AWS SDK for pandas 3.16.1 · AWS disclosed and patched an ownership flaw in the AWS SDK for pandas Athena module.
• AWS discloses OAuth bypass CVE-2026-115413 in API MCP Server · AWS published security alert for OAuth validation flaw in API MCP Server versions 1.3.0 to 1.5.9
• AWS discloses CVE-2026-115418 SQL injection flaw in Redshift CDK module · AWS published a security bulletin for CVE-2026-115418 affecting the @aws-cdk/aws-redshift-alpha module.
• AWS SDK for Go v2 denial of service vulnerability CVE-2026-89090 disclosed · AWS published security bulletin for CVE-2026-89090 flaw in AWS SDK for Go v2.
• CVE-2026-18061 XXE Vulnerability Found In AWS Advanced JDBC Wrapper · AWS disclosed CVE-2026-18061 XXE flaw in JDBC Wrapper versions 3.3.0 to 4.2.0.
• CVE-2026-85787 vulnerability disclosed for Amazon postgres-mcp-server · Amazon published a security alert for CVE-2026-85787 affecting postgres-mcp-server <1.1.7.
• Critical command execution flaw patched in Amazon awslabs postgres-mcp-server · CVE-2026-87911 enables OS command execution in postgres-mcp-server versions before 1.1.7.
• AWS issues security bulletin for CVE-2026-111943 eMudhra CA flaw · AWS published guidance for recoverable eMudhra CA private keys in AWS trust bundles
• AWS Patches CVE-2026-115845 Arbitrary Code Flaw In MCP Server Sandbox · AWS fixed CVE-2026-115845, an incomplete validation flaw in MCP Server Python sandbox.
• AWS Labs patches mysql-mcp-server read-only bypass vulnerability CVE-2026-85788 · Security flaw in awslabs mysql-mcp-server fixed in released version 1.0.23
• CVE-2026-115419 session flaw patched in Strands Agents SDK · Strands Agents SDK fixes critical session data disclosure vulnerability CVE-2026-115419.
• AWS fixes CVE-2026-115416 authorization flaw in Amazon Athena v3 · AWS patched an authorization vulnerability in Amazon Athena engine version 3.
• Critical CVE-2026-83497 flaw disclosed in OpenSearch SQL Plugin · AWS published a security bulletin for a remote code execution flaw in OpenSearch SQL Plugin.
• Amazon SageMaker Python SDK vulnerability CVE-2026-112408 disclosed with patches · AWS discloses missing ownership check flaw in SageMaker Python SDK default bucket function
• AWS discloses privilege escalation vulnerability CVE-2026-112407 in serverless CI/CD toolchain · AWS published a security bulletin for CVE-2026-112407 affecting its serverless CI/CD toolchain.
• CVE-2026-112380 authorization flaw patched in Kiro Crew 0.7.2 · AWS security bulletin discloses patched vulnerability in Kiro Crew WhatsApp channel.
• AWS discloses two FreeRTOS-Kernel vulnerabilities patched in version 11.3.2 · AWS published a security bulletin for flaws in FreeRTOS-Kernel Arm Cortex-R82 MPU builds.
• AWS discloses two security vulnerabilities in FreeRTOS-Plus-TCP stack · AWS published a security bulletin for two flaws in FreeRTOS-Plus-TCP versions up to 4.4.1.
• AWS discloses Linux kernel virtio-net vulnerability CVE-2026-99999 · AWS published a security bulletin for a Linux kernel flaw affecting self-managed KVM hypervisors.
• Amazon Neptune discloses CVE-2026-110812 deserialization vulnerability · AWS published a security bulletin for a flaw in Amazon Neptune graph database.
• AWS discloses CVE-2026-110310 flaw in .NET S3 Encryption Client · AWS published a security bulletin for a padding oracle flaw in its S3 .NET Encryption Client.
• Amazon SageMaker Python SDK credential leak vulnerability disclosed · AWS publishes security bulletin for CVE-2026-110248 credential logging flaw
• Two Security Vulnerabilities Disclosed In AWS s2n-tls Library · AWS publishes security bulletin for flaws in open-source s2n-tls TLS implementation.
• AWS Patched AgentCore SDK Vulnerability Exposing User Prompts · AWS fixed a vulnerability in the AgentCore Python SDK that leaked sensitive prompts to CloudWatch logs.
• AWS Issues Critical Patch for Strands Agents Elasticsearch Memory SSRF Vulnerability · AWS released a fix for CVE-2026-15746, an SSRF vulnerability in Strands Agents Tools that exposed API keys.
• AWS discloses CVE-2026-16796 flaw in Bedrock AgentCore Python SDK · AWS published a security advisory for a command injection flaw in Bedrock AgentCore SDK.