CLEANSTART-2026-VY69341 Security fixes for CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-25680, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-33814, CVE-2026-39821, CVE-2026-39833, CVE-2026-39836, CVE-2026-42499, CVE-2026-42504, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-p436-gjf2-799p applied in versions: 7.1.1-r0, 7.1.1-r1, 7.1.1-r3, 7.1.1-r4, 7.1.1-r5

Multiple security vulnerabilities affect the minio-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack

Security firm Sysdig says it has found what it believes is the first ransomware attack run from start to finish by an AI agent. Its Threat Research Team calls the operator JADEPUFFER and says a large language model handled the whole job: breaking in, stealing credentials, moving deeper into the...

CVE-2026-54352

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...

CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, nerdctl, backup-restore-operator, rancher, istio, drone, zarf-fips, spire-server, knative-serving-fips, osv-scanner, flux-fips, traefik-fips, tigera-operator, gitea-fips, cloudbeat-fips, etcd, flux-source-controller, frankenphp-8.5, frankenphp-8.4...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: age, osv-scanner, kaf, snyk-cli, external-dns, crossplane-provider-azure-sql, pulumi-language-yaml, rancher-machine, kine, containerd, cosign, flux-kustomize-controller, steampipe, gatus, tekton-chains, k3s, sops, chezmoi, kots, k9s, gitlab-runner, gh, terragrunt,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: osv-scanner, istio, external-secrets-operator, kaf, snyk-cli, external-dns, gitea, cilium, loki, trivy, kine, containerd, prometheus, k3s, zot, aactl, kots, k9s, prometheus-operator, kubernetes, argocd-image-updater, flux-image-automation-controller, gitlab-kas, flux...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: osv-scanner, kaf, snyk-cli, external-dns, pulumi-language-yaml, kine, containerd, k3s, chezmoi, kots, k9s, terragrunt, guac, cert-manager, podman, spire-server, telegraf, docker-cli-buildx, kyverno, step-kms-plugin, flux-source-controller, opentofu, nfpm, prometheus,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: osv-scanner, istio, external-secrets-operator, kaf, snyk-cli, external-dns, gitea, cilium, loki, trivy, kine, containerd, prometheus, k3s, zot, aactl, kots, k9s, prometheus-operator, kubernetes, argocd-image-updater, flux-image-automation-controller, gitlab-kas, flux...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: istio, external-secrets-operator, kaf, snyk-cli, external-dns, cilium, loki, kine, containerd, prometheus, k3s, zot, aactl, kots, prometheus-operator, kubernetes, rancher, gitlab-kas, flux, cert-manager, mattermost, minio, podman, kubernetes-dashboard, spire-server,...

GO-2026-5757 MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio

MinIO vulnerable to Path Traversal via msgpack Body in ReadMultiple Storage-REST Endpoint in github.com/minio/minio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-5437 MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio

MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio...

GO-2026-5415 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing in github.com/minio/minio

MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing in github.com/minio/minio...

GO-2026-5284 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio...

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

Summary POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting...

ROOT-APP-GOBINARY-CVE-2026-40344 CVE-2026-40344 in rootio-github.com/minio/minio - Patched by Root

Root has patched CVE-2026-40344 in the rootio-github.com/minio/minio package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-41145 CVE-2026-41145 in rootio-github.com/minio/minio - Patched by Root

Root has patched CVE-2026-41145 in the rootio-github.com/minio/minio package for Root:Go. Multiple fixed versions available...

MinIO RELEASE.2022-07-24T01-54-52Z < RELEASE.2026-04-14T21-32-45Z Path Traversal (CVE-2026-42600)

The version of MinIO installed on the remote host is RELEASE.2022-07-24T01-54-52Z or later but prior to RELEASE.2026-04-14T21-32-45Z. It is, therefore, affected by a path traversal vulnerability: - A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a...

PenguinMod-BackendApi 输入验证错误漏洞

PenguinMod-BackendApi is a backend API service developed under the open source of PenguinMod, supporting storage using MongoDB and MinIO. Prior to version 1.0.0 of PenguinMod-BackendApi, there was a vulnerability related to input validation errors. This vulnerability stemmed from NoSQL injection ...

CLEANSTART-2026-ZL51442 When returning errors, functions in the net/textproto package would include its input as part of the error

Multiple security vulnerabilities affect the minio-operator package. When returning errors, functions in the net/textproto package would include its input as part of the error. See references for individual vulnerability details...