PT-2026-83233

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.4.0 Description An authenticated user can enumerate tasks across different tenants and modify their completion metadata. This occurs because the endpoint "/api/v1/projects/project/views/view/buckets/bucket/tasks"...

CVE-2026-77611 SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler...

CVE-2026-19485

CVE-2026-19485 is a Predictable Resource Name (bucket squatting) vulnerability in BigQuery Import Staging within Google Cloud Vertex AI Search for Commerce on Google Cloud Platform, affecting versions prior to 2026-04-27 . An attacker knowing the victim's project number could derive the predictab...

EUVD-2026-66653

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

GHSA-6X9P-4R67-5GJX Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

CVE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-s3 versions 23.0.4...

GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-cloudinary versions 26.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-dos versions 23.0.4...

GO-2026-6221 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs...

PT-2026-80444

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs...

CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

Ivanti Endpoint Manager < 2024 SU7 Multiple Vulnerabilities

The version of Ivanti Endpoint Manager running on the remote host is prior to 2024 SU7. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent servic...

PT-2026-76785

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description An authenticated published-app user with the BASIC role can provide attacker-controlled bucket and key values to the 'POST /api/attachments/:datasourceId/url' endpoint. This allows the user to obta...

CVE-2026-72859

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...