Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Analysed #2926361 Valid Other weaknesses Medium 2025-04-24 – 37 Non-Production API Endpoints for the bedrock-agent Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Analysed #2800091 Valid Other weaknesses Medium 2025-05-28 – 38 Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration Analysed #3021451 Valid Other weaknesses Medium 2025-04-25 – 40 V1Plugin.Decrypt panics on empty ciphertext (Remote DoS) Analysed #3620748 Valid Memory Corruption Medium 2026-05-28 – 41 Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Analysed #3009411 Valid Other weaknesses Medium 2025-03-11 – 45 bedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keys Analysed #3702072 Valid Misconfiguration and Insecure Design Medium 2026-07-14 – 45 Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs` Analysed #3558713 Valid Command and Code Injection High 2026-06-11 – 48 Bedrock AgentCore Starter Toolkit Creates Gateway IAM Roles Without Confused Deputy Protections Analysed #3632577 Valid Access Control Medium 2026-07-15 – 48 Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Analysed #2981210 Valid Other weaknesses Medium 2025-02-26 – 50 Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644) Analysed #3630605 Valid Access Control Medium 2026-07-09 – 54 A potential risk in the experimental-programmatic-access-ccft which can be used to privilege escalation. Analysed #2808412 Valid Access Control High 2024-11-06 – 55 (Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Analysed #3014785 Valid Other weaknesses Medium 2025-04-08 – 56 QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions Denial Analysed #3577145 Valid No weakness recorded None 2026-05-12 – 59 A potential risk in the aws-lambda-ecs-run-task which can be used to privilege escalation. Analysed #2894222 Valid Access Control Medium 2024-12-27 – 68 Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration Analysed #3780277 Valid Other weaknesses Medium 2026-07-02 – 69 Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration Analysed #3022516 Valid Other weaknesses Medium 2025-03-24 – 75 OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE) Analysed #3637898 Valid Command and Code Injection High 2026-07-06 – 111