123360 matches found
CVE-2026-50137
Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...
EUVD-2026-39913
Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...
EUVD-2026-39912
Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require...
CVE-2026-50136
Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require...
CVE-2026-12411
creationtimestamp| type| source ---|---|--- 2026-06-26 19:55:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7pzez34222 2026-07-15 00:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnghcoj4l25...
CVE-2026-45408
creationtimestamp| type| source ---|---|--- 2026-06-26 18:19:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7kmzy3za2c 2026-06-28 05:06:57+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpd7btxcpw2h 2026-06-30 01:07:07+00:00| seen|...
CVE-2026-57915
creationtimestamp| type| source ---|---|--- 2026-06-26 18:01:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mp7jmkg4ps23 2026-06-27 19:40:02+00:00| seen| https://bsky.app/profile/canartuc.com/post/3mpc7m3lt342p...
CVE-2026-56067
creationtimestamp| type| source ---|---|--- 2026-06-26 17:55:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7jbvjreo26...
CVE-2026-57658
creationtimestamp| type| source ---|---|--- 2026-06-26 17:50:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7iyw7ru62c...
CVE-2026-56070
creationtimestamp| type| source ---|---|--- 2026-06-26 17:42:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7ikigsze2x...
CVE-2025-60464
creationtimestamp| type| source ---|---|--- 2026-06-26 17:36:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mp7i7rohct2t...
CVE-2026-57644
creationtimestamp| type| source ---|---|--- 2026-06-26 17:18:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7hamu34j27 2026-07-05 08:16:31+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpv55are6d22...
CVE-2026-57642
creationtimestamp| type| source ---|---|--- 2026-06-26 17:17:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7h5s5m7g27 2026-07-06 07:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpxk6fmbje24...
CVE-2026-57662
creationtimestamp| type| source ---|---|--- 2026-06-26 17:15:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7h33vnsu2q 2026-06-30 07:17:24+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpihiwfvug2i...
CVE-2016-5062
creationtimestamp| type| source ---|---|--- 2026-06-26 17:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp7glqfll32g...
Malicious code in xrblocks-remote-control (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e20199ccf4c5557bf9d6bd0f17f0f74b47aa54389f22247523fb9145ef29def Package xrblocks-remote-control ships a bin script that, when invoked including via npx or unintended resolution against the xrblocks name, POSTs the...
CVE-2026-28385
CVE-2026-28385 : Canonical LXD 4.12–6.9 contains an SSRF in image import from URL sources. Authenticated users with the can_create_images entitlement can leverage the /images endpoint to trigger outbound requests from the LXD daemon, failing to validate or restrict destinations. This allows conta...
CVE-2026-28385 SSRF via image import from URL allows internal network probing by authenticated users
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...
EUVD-2026-39779
Mattermost versions 10.11.x = 10.11.18, 11.6.x = 11.6.3, 11.5.x = 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery SS...