Vulnerability · Confirmed · AWS

Generated 5 Nov 2026, 08:55 UTC · Live view: news.rogelio.cloud/?category=vulnerability&label=Confirmed&vendor=AWS

Executive summary

14 stories in the last 30 days; 14 (100%) confirmed by official sources.
No actively exploited vulnerabilities in this selection.
Most common topic: Vulnerability (14).
Most reported vendor: AWS (14 stories).

Stories

Actively exploited

Breaches & ransomware

Confirmed by official sources

Stories per day

Daily breakdown, last 14 days

Exploited Breach / ransomware Other

Topics

Vulnerability — 14 (100%)

Most reported vendors

Top stories

#	Story	Confidence	Updated
1	CVE-2026-122192 - Guest Access to Firecracker Process Memory After a Failed Memory Discard Original article	Confirmed 100 Vulnerability	4 Nov 2026
2	CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass Original article	Confirmed 100 Vulnerability	3 Nov 2026
3	CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering Original article	Confirmed 100 Vulnerability	3 Nov 2026
4	CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server Original article	Confirmed 100 Vulnerability	2 Nov 2026
5	CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS Original article	Confirmed 100 Vulnerability	2 Nov 2026
6	CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows Original article	Confirmed 100 Vulnerability	2 Nov 2026
7	CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas Original article	Confirmed 100 Vulnerability	2 Nov 2026
8	CVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C Original article	Confirmed 100 Vulnerability	30 Oct 2026
9	CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes Original article	Confirmed 100 Vulnerability	29 Oct 2026
10	CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas Original article	Confirmed 100 Vulnerability	28 Oct 2026
11	CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Original article	Confirmed 100 Vulnerability	26 Oct 2026
12	CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles Original article	Confirmed 100 Vulnerability	25 Oct 2026
13	CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server Original article	Confirmed 100 Vulnerability	23 Oct 2026
14	CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt Original article	Confirmed 100 Vulnerability	22 Oct 2026

Vulnerabilities to watch

CVE	Exploited	CVSS	EPSS
CVE-2026-111943	No	—	0.4%
CVE-2026-115417	No	—	0.4%
CVE-2026-119301	No	—	0.3%
CVE-2026-105811	No	—	0.3%
CVE-2026-116635	No	—	0.3%
CVE-2026-115845	No	—	0.3%
CVE-2026-121652	No	—	0.3%
CVE-2026-120497	No	—	0.2%
CVE-2026-119148	No	—	0.2%
CVE-2026-115418	No	—	0.2%
CVE-2026-118029	No	—	0.2%
CVE-2026-119115	No	—	0.2%

Sources: official agencies, vendor security teams and the security press, linked from each story. Confidence scores reflect who reported each story. Tags and summaries are generated automatically and may be incomplete.