CVE-2026-59992

Authenticated CMS editors can pass arbitrary object keys to PutObject/DeleteObject calls across four media adapters (S3, DOS, Azure, Cloudinary), bypassing mediaRoot boundaries. Fix: upgrade to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, or next-tinacms-cloudinary ...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-54330

A flaw was found in Ceph RGW's SigV4 signature verification handler. When processing S3 requests, RGW verifies only the headers explicitly listed in the X-Amz-SignedHeaders field but does not reject requests that carry additional unsigned x-amz- headers. This diverges from the AWS S3 specificatio...

Malicious Package

Overview devplatform-s3-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-58372

A flaw was found in SeaweedFS. An authenticated remote attacker with write access to a single bucket could exploit a path traversal vulnerability in the S3 gateway. By crafting a DeleteObjects XML request body with specific object keys containing directory traversal sequences, the attacker could...

CVE-2026-59992: Authorization Bypass Through User-Controlled Key

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

PT-2026-80252

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

GO-2026-6093 AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk...

GO-2026-6196 S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone...

GO-2026-6189 Path traversal in serve s3 in github.com/rclone/rclone

Path traversal in serve s3 in github.com/rclone/rclone...

GO-2026-6188 S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone...

GO-2026-6221 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs...

ANT-2026-XKHXVCFV · supabase/postgres · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-XKHXVCFV: Root-executed binaries fetched from S3 without integrity check Several Ansible tasks admin-mgr.yml:11,...

PT-2026-80421

S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone...

PT-2026-80444

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs...

PT-2026-80422

Path traversal in serve s3 in github.com/rclone/rclone...

PT-2026-80340

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk...

PT-2026-80427

S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone...

CVE-2026-54356

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...