Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-127119

Unverified ownership of the default EMR cluster log location in AWS SDK for pandas

Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.

CVSS 4.0 · 5.9 Medium EPSS n/a KEV · Not listed
Vendors
Aws
Products
Aws-sdk-pandas
CVE-2026-118029

Unverified ownership of the default Athena query result location in AWS SDK for pandas

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket.  To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-sdk-pandas
CVE-2026-119301

Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

CVSS 4.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-sdk-pandas