nimbostratus

Nimbostratus ============ Amazon 클라우드 인프라를 핑거프린팅하고 익스플로잇하기 위한 도구입니다. 이 도구들은 제 "Pivoting in Amazon clouds" 발표를 위해 개발한 PoC이며, Amazon API에 접근하기 위한 훌륭한 boto 라이브러리를 사용하여 개발되었습니다. 자세한 정보는 프로젝트 페이지를 방문하세요. 버그를 신고하거나, 포크해서 풀 리퀘스트를 보내주세요. @w3af로 연락하실 수도 있습니다...

Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords

Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS Amazon Web Services IoT Internet of Things policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords. A...

GHSA-GVRM-XH5G-W8V6 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

GHSA-WFX4-V2WF-4GMP vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

GHSA-MRV3-46FP-R6HH vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

CVE-2026-53203 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

CVE-2026-53216 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

"The fluent-plugin-s3 plugin specifically the ins3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limi...

CVE-2026-31600 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-vmware...

GHSA-4GX5-8RX4-VXMJ vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-vmware...

UBUNTU-CVE-2026-33551

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role...

GHSA-WGXF-R68R-7W9H vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-vmware...

GHSA-G4VW-3HQ5-Q7GR vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-vmware...

CVE-2025-38205 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-vmware...

CVE-2026-23226 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-vmware...

CVE-2026-23210 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-vmware...

EUVD-2026-18019

Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints...

CVE-2026-34750

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...

CLEANSTART-2026-ZW38648 Security fixes for CVE-2025-47911, CVE-2025-58190, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-p77j-4mvh-x3m3 applied in versions: 1.12.2-r2, 1.12.2-r3

Multiple security vulnerabilities affect the velero-plugin-for-aws package. These issues are resolved in later releases. See references for individual vulnerability details...

Incorrect Authorization

Overview @studiocms/s3-storage is an Add S3 Storage Support into your StudioCMS project. Affected versions of this package are vulnerable to Incorrect Authorization via the S3ApiService POST/PUT handlers in the S3 storage manager. An attacker can gain full S3 file management upload, delete, renam...