301 matches found
CVE-2026-34750 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...
PT-2026-29598
Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.78.0 Description The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. Recommendations...
[SECURITY] Fedora 44 Update: rust-reqsign-azure-storage-3.0.0-1.fc44
Azure Storage signing implementation for reqsign...
azure-storage-azcopy-10.32.2-1.1 on GA media (moderate)
azure-storage-azcopy-10.32.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10407-1 Rating: moderate Cross-References: CVE-2026-33186 CVSS scores: CVE-2026-33186 SUSE : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2026-33186 SUSE : 8.6...
OPENSUSE-SU-2026:10407-1 azure-storage-azcopy-10.32.2-1.1 on GA media
These are all security issues fixed in the azure-storage-azcopy-10.32.2-1.1 package on the GA media of openSUSE Tumbleweed...
org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.645)
org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...
org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.645)
org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...
CVE-2025-10749
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated...
WordPress plugin Microsoft Azure Storage security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plugin A...
CVE-2025-10749
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated...
CVE-2025-10749 Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated...
CVE-2025-10749
CVE-2025-10749 describes a vulnerability in the Microsoft Azure Storage for WordPress plugin (all versions up to 4.5.1) where missing capability checks on the azure-storage-media-replace AJAX action allow authenticated users with subscriber-level access or higher to delete arbitrary media in the ...
CVE-2025-10749: Missing Authorization
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated...
PT-2025-43588
Name of the Vulnerable Software and Affected Versions Microsoft Azure Storage for WordPress plugin for WordPress versions up to and including 4.5.1 Description The software is susceptible to unauthorized arbitrary media deletion. This is a result of missing capability checks on the...
WordPress Microsoft Azure Storage for WordPress plugin <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Media Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Microsoft Azure Storage for WordPress versions = 4.5.1...
A Cascade of Insecure Architectures: Axis Plugin Design Flaw Expose Select Autodesk Revit Users to Supply Chain Risk
We discovered Azure Storage Account credentials exposed in Axis Communications’ Autodesk Revit plugin, allowing unauthorized modification of cloud-hosted files. This exposure, combined with vulnerabilities in Autodesk Revit, could enable supply-chain attacks targeting end users...
EUVD-2022-6258
Malicious code in bioql PyPI...
EUVD-2024-18391
Malicious code in bioql PyPI...