Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

oss

oss 中文 |English Herramienta de línea de comandos para almacenamiento de objetos multicloud basada en el protocolo S3. Un solo binario para operar el almacenamiento de objetos de los principales proveedores de nube: AWS S3, Alibaba Cloud OSS, Tencent Cloud COS, Huawei Cloud OBS, Baidu Cloud BOS,...

bucketbuster

BucketBuster Escáner de exposición de almacenamiento de objetos en la nube para pruebas de seguridad autorizadas, trabajo de bug bounty e infraestructura propia. BucketBuster comprueba nombres de buckets candidatos contra endpoints públicos de Yandex Cloud, VK Cloud, Selectel, SberCloud, Alibaba...

@fdm-monster/server (>=2.0.11, <=2.1.1), @objectif-lune/node-red-contrib-ftp (>=1.1.0, <=1.2.0) +2 more potentially affected by CVE-2026-102990 via basic-ftp (>=6.0.1, <=6.2.0)

basic-ftp NPM version =6.0.1, =2.0.11, =1.1.0, =1.0.0, =2.0.3-beta, =2.1.4-1257-beta.1 Source cves: CVE-2026-102990 Source advisory: OSV:GHSA-C475-QRG2-PJ4R...

The vulnerability of the MinIO object storage server, related to the unlimited distribution of resources, allows a attacker to cause a service failure.

The vulnerability of the MinIO object storage server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the MinIO object storage server, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of the MinIO object storage server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to increase their privileges...

The vulnerability of the MinIO object storage server, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of the MinIO object storage server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to increase their privileges...

Release Information for Veeam Backup for Microsoft 365 8.6

Requirements This release can be used to: upgrade an existing v8, v8.1, v8.2, v8.3, v8.4, or v8.5 deployment of Veeam Backup for Microsoft 365 to v8.6. install a new deployment of Veeam Backup for Microsoft 365 v8.6. After installing this release, the Veeam Backup for Microsoft 365 build number...

EUVD-2026-72107

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...

CVE-2026-32637

A flaw was found in Velero, an open-source tool for managing Kubernetes backups. An attacker who compromises the backup object-storage backend can upload a specially crafted malicious backup file. During the restore process, this malicious file can exploit a path traversal vulnerability to...

CVE-2026-82285

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285: Server-Side Request Forgery (SSRF)

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-32637

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-32637

Velero is an open-source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1 , a file path traversal vulnerability exists during restore: an attacker who compromises the backup object-storage backend can upload a malicious tarball con...

[SECURITY] Fedora 43 Update: ceph-19.2.6-1.fc43

Ceph is a massively scalable, open-source, distributed storage system that ru ns on commodity hardware and delivers object, block and file system storage...

CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...

CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...

CVE-2026-54457

TensorZero (open-source LLMOps platform) is vulnerable to arbitrary file read and SSRF via its Gateway /internal/object_storage endpoint in versions prior to 2026.6.0 . The endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration...

CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...