AWS Security Agent plugin vulnerabilities

Latest AWS Security Agent plugin CVEs

Newest publication first

1. CVE-2026-87912 Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

   Published 2026-09-10

   Medium·CVSS 5.1 EPSS 0.44%

   A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.