nimbostratus

Nimbostratus Tools zum Fingerprinting und Ausnutzen von Amazon-Cloud-Infrastrukturen. Diese Tools sind ein PoC, den ich für meinen Vortrag "Pivoting in Amazon clouds" entwickelt habe, und basieren auf der großartigen boto-Bibliothek für den Zugriff auf die Amazon-API. Weitere Informationen findes...

Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords

Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS Amazon Web Services IoT Internet of Things policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords. A...

GHSA-GVRM-XH5G-W8V6 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

GHSA-MRV3-46FP-R6HH vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-53203 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

GHSA-WFX4-V2WF-4GMP vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-53216 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-31600 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

GHSA-4GX5-8RX4-VXMJ vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

UBUNTU-CVE-2026-33551

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role...

GHSA-WGXF-R68R-7W9H vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

GHSA-G4VW-3HQ5-Q7GR vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

CVE-2025-38205 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

CVE-2026-23226 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

CVE-2026-23210 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

EUVD-2026-18019

Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints...

CVE-2026-34750

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...

CLEANSTART-2026-ZW38648 Security fixes for CVE-2025-47911, CVE-2025-58190, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-p77j-4mvh-x3m3 applied in versions: 1.12.2-r2, 1.12.2-r3

Multiple security vulnerabilities affect the velero-plugin-for-aws package. These issues are resolved in later releases. See references for individual vulnerability details...

Incorrect Authorization

Overview @studiocms/s3-storage is an Add S3 Storage Support into your StudioCMS project. Affected versions of this package are vulnerable to Incorrect Authorization via the S3ApiService POST/PUT handlers in the S3 storage manager. An attacker can gain full S3 file management upload, delete, renam...

CVE-2026-1776 Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read

Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...