CVE-2026-114083 Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences ...

CVE-2026-114083

Trigger.dev versions prior to 4.5.0-rc.3 are vulnerable to a path traversal vulnerability within the api/v1/packets and api/v2/packets endpoints. The root cause is an unsanitized filename splat segment , which allows authenticated tenants to escape their designated object key prefix. By providing...

CVE-2026-114083 Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences ...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-94368

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

EUVD-2026-83898

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 SigV4. Due to improper validation, the service fails to reject requests containi...

CVE-2026-54330

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

EUVD-2026-67276

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-54330

CVE-2026-54330 affects the Ceph Object Gateway (RGW) SigV4 verifier in versions prior to 20.2.4 and 19.2.6 . The handler fails to reject requests carrying x-amz-* headers that are absent from the signed header set, unlike AWS S3 which rejects such unsigned headers. An attacker holding a presigned...

CVE-2026-54330

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

PT-2026-82771

Name of the Vulnerable Software and Affected Versions Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6 Description The Ceph Object Gateway RGW SigV4 handler fails to reject requests containing x-amz- headers that are not included in the signed header set. While AWS S3 requires all x-am...

GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

CVE-2026-54330

A flaw was found in Ceph RGW's SigV4 signature verification handler. When processing S3 requests, RGW verifies only the headers explicitly listed in the X-Amz-SignedHeaders field but does not reject requests that carry additional unsigned x-amz- headers. This diverges from the AWS S3 specificatio...

EUVD-2026-62589

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...

CVE-2026-72859

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

EUVD-2026-58653

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...