Confirmed 100VulnerabilityFirst seen 2 Nov 2026, 19:19 UTC

CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Coverage

Headline	Source	Type	Published
CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows	AWS Security Bulletins	Official	2 Nov 2026, 19:19 UTC

CVE	Exploited (CISA KEV)	CVSS	EPSS
CVE-2026-120497	No	—	—

CVSS from NVD; EPSS is FIRST’s estimate of the chance of exploitation in the next 30 days.

Confidence	100 · Confirmed
Most trusted source	90
Independent organisations reporting it (1)	+0
Confirmed by an official source or CISA KEV	+10

We link to the original reporting and don’t reproduce it. Read the sources above for the full details.