CVE-2026-12957

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

June 26, 2026

Last Seen

August 25, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Amazon Q Developer Vulnerability Enables Cloud Credential Theft74.0

A high-severity vulnerability (CVE-2026-12957) in Amazon Q Developer for Visual Studio Code allowed attackers to execute arbitrary code and steal AWS credentials by automatically loading malicious MCP server configurations from cloned repositories. Discovered by Wiz Research, the flaw permits silent...

GitHub Agentic Workflows Vulnerability Exposes Private Repositories67.5

In July 2026, Noma Labs discovered a prompt injection vulnerability in GitHub's Agentic Workflows, named GitLost, allowing unauthenticated attackers to access private repositories by crafting a GitHub Issue in a public repository. The vulnerability exploits the AI agent's failure to distinguish betw...