CVE-2026-116164

Parse Server versions before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 are vulnerable to a Reserved Field Name Injection via object writes. The root cause is the failure to reject reserved internal field names during client object writes, allowing attackers to store or clear internal fields. This c...

CVE-2026-41145

MinIO contains an authentication bypass in the STREAMING-UNSIGNED-PAYLOAD-TRAILER code path, affecting releases prior to RELEASE.2026-04-11T03-20-12Z. An attacker with a valid access key (including default minioadmin or any key with WRITE on a bucket) can write objects to any bucket without a val...

CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads PostObject, allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enabl...

CVE-2026-27607

RustFS is affected by a vulnerability in versions 1.0.0-alpha.56 through 1.0.0-alpha.82 where presigned POST uploads (PostObject) do not validate policy conditions. The server bypasses content-length-range, starts-with, and Content-Type constraints, allowing unauthorized file uploads that can exc...