Read the docs

AWS

Records384All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical46CVSS 9.0–10.0
CVSS high198CVSS 7.0–8.9

Exploited now

AWS records in CISA KEV
TI-2026-23989 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability Priority CRITICAL 93KEV 2026-05-01TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10

Components

Products in the NVD configurations · select one to filter the records
Freertos 21 records MEDIUM Amazon Web Services Freertos 14 records MEDIUM Fire Os 13 records MEDIUM Opensearch 11 records HIGH Tough 10 records MEDIUM Freertos-plus-tcp 9 records MEDIUM Blink Xt2 Sync Module Firmware 7 records MEDIUM Athena Odbc 6 records MEDIUM

Records

10 records in Tough · all components

TI-2020-11868 CVE-2020-15093 · GHSA-5q2r-92f9-4m49

Improper verification of signature threshold in tough

Priority MEDIUM 40

The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01357 Published 2020-07-09 Fixed in 0.7.1 CWE-347
TI-2021-17989 CVE-2021-41150 · GHSA-r56q-vv3c-6g9c

Improper sanitization of delegated role names in tough

Priority LOW 38

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.01281 Published 2021-10-19 Fixed in 0.12.0 CWE-22
TI-2021-17988 CVE-2021-41149 · GHSA-x3r5-q6mj-m485

Improper sanitization of target names in tough

Priority LOW 38

Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.01113 Published 2021-10-19 Fixed in 0.12.0 CWE-22
TI-2026-06100 CVE-2026-6968

Multiple Path Traversal Variants in awslabs/tough

Priority LOW 32

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00533 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-22
TI-2026-06099 CVE-2026-6967 · GHSA-4v58-8p28-2rq3

Missing Delegated Metadata Validation in awslabs/tough

Priority LOW 31

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integ…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00253 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-345
TI-2026-06098 CVE-2026-6966 · GHSA-8m7c-8m39-rv4x

Signature Threshold Bypass in awslabs/tough Delegated Roles

Priority LOW 31

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplic…

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.00283 Published 2026-04-24 Fixed in 0.22.0, 0.15.0 CWE-347
TI-2025-02522 CVE-2025-2887 · GHSA-q6r9-r9pw-4cf7

Failure to detect delegated target rollback in tough

Priority LOW 26

During a target rollback, the client fails to detect the rollback for delegated targets.

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.00332 Published 2025-03-27 Fixed in 0.20.0 CWE-1025
TI-2025-02521 CVE-2025-2886 · GHSA-v4wr-j3w6-mxqc

Terminating targets role delegations are not respected in tough

Priority LOW 26

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation.

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.00332 Published 2025-03-27 Fixed in 0.20.0 CWE-670
TI-2025-02520 CVE-2025-2885 · GHSA-5vmp-m5v2-hx47

Root metadata version not validated in tough

Priority LOW 26

Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by…

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.00332 Published 2025-03-27 Fixed in 0.20.0 CWE-1288
Open these records in search →