Advisories · Technology

AWS Ops Wheel.

Every CVE that names AWS Ops Wheel among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-18481 CVE record

CVSS 6.2 Medium

Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft
- AWS Ops Wheel
- Cross-site scripting (XSS)
Not analysed yet 31 Jul 2026
CVE-2026-6912 CVE record

CVSS 8.7 High

Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel
- AWS Ops Wheel
- Broken access control
Not analysed yet 24 Apr 2026
CVE-2026-6911 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel
- AWS Ops Wheel
- Weak cryptography or TLS
Not analysed yet 24 Apr 2026