CyberSIXT Search
Vendor

AWS

No AWS CVE is in the CISA KEV catalogue.

Tracked since 26 Jun · latest article Fri 16 Oct · RSS

High exploit odds · current
0
high · not in KEV

Exploited, by due date

CSV download

No AWS CVE is in the CISA KEV catalogue.

Products

6 products · 9 CVEs in coverage
loom3 CVEs · 0 in KEVlatest 2 Octbedrock-agentcore2 CVEs · 0 in KEVlatest 29 SepAmazon Neptune Engine1 CVEs · 0 in KEVlatest 16 Octsagemaker-distribution1 CVEs · 0 in KEVlatest 2 OctAmazon SSM Agent1 CVEs · 0 in KEVlatest 11 Sep
1 more productsLanguage Servers for AWS1 CVEs · 0 in KEVlatest 26 Jun

Coverage

5 articles · all timeFull timeline →

5 articles from 3 outlets since 26 Jun; the latest 10 days ago.

AWS: coverage over time5 articles from 3 outlets. First report 26 Jun by SecurityWeek. Busiest week: 2 articles, week of 28 Sep. 0 in the last 7 days. AWS: coverage over time5 articles from 3 outlets. First report 26 Jun by SecurityWeek. Busiest week: 2 articles, week of 28 Sep. 0 in the last 7 days.
  • Article
  • First report
Show as table
AWS: articles
Published (UTC)OutletHeadline
Fri 16 Oct · 03:14 UTCSecurityOnlineAWS Patches Critical Neptune Flaw That Could Enable Engine Abuse
Fri 2 Oct · 23:30 UTCSecurityOnlineAWS Patches Critical Loom Flaw Allowing Full Admin Takeover
Tue 29 Sep · 14:25 UTCInfosecurityAmazon Bedrock SDK Flaws Expose AWS Credentials to Sandbox Attacks
Fri 11 Sep · 14:42 UTCSecurityOnlineAmazon Patches Critical SSM Flaw Exposing AWS Instance Credentials
Fri 26 Jun · 15:31 UTCSecurityWeekAmazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories

Who reported 3 outlets, last 12 months

  • SecurityOnline3
  • SecurityWeek1
  • Infosecurity1
See the full timeline
  1. AWS Patches Critical Neptune Flaw That Could Enable Engine AbuseSecurityOnline
  2. AWS Patches Critical Loom Flaw Allowing Full Admin TakeoverSecurityOnline
  3. Amazon Bedrock SDK Flaws Expose AWS Credentials to Sandbox AttacksInfosecurity
  4. Amazon Patches Critical SSM Flaw Exposing AWS Instance CredentialsSecurityOnline
  5. Amazon Q Flaw Enabled Cloud Credential Theft via Malicious RepositoriesSecurityWeek

All CVEs in coverage

9
CVE-2026-103956AWS loom vulnerabilityCVSS10.0Critical–Not in KEV2.5%EPSS1article
CVE-2026-104019AWS sagemaker-distribution vulnerabilityCVSS9.3Critical–Not in KEV1.4%EPSS1article
CVE-2026-16796AWS bedrock-agentcore 1.18.1 vulnerabilityCVSS8.4High–Not in KEV0.7%EPSS1article
CVE-2026-89049AWS Amazon SSM Agent vulnerabilityCVSS9.9Critical–Not in KEV0.7%EPSS1article
CVE-2026-103957AWS loom vulnerabilityCVSS8.2High–Not in KEV0.4%EPSS1article
CVE-2026-110812AWS Amazon Neptune Engine vulnerabilityCVSS9.9Critical–Not in KEV0.4%EPSS1article
CVE-2026-103958AWS loom vulnerabilityCVSS8.3High–Not in KEV0.3%EPSS1article
CVE-2026-12530Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()CVSS8.4High–Not in KEV0.3%EPSS1article
CVE-2026-12957Arbitrary Code Execution in Language Servers for AWSCVSS8.5High–Not in KEV0.2%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device