102 matches found
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-111748 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-111748 Source advisory: OSV:GHSA-F9XW-JH8M-3MWQ...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-111749 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-111749 Source advisory: OSV:GHSA-GX76-C99X-2C96...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-111065 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-111065 Source advisory: OSV:GHSA-6CJC-53GC-5RQM...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-111750 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-111750 Source advisory: OSV:GHSA-PQXQ-W44R-73XW...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-111064 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-111064 Source advisory: OSV:GHSA-5WR8-GCQF-GQF3...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-111063 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-111063 Source advisory: OSV:GHSA-494J-54XM-RWP3...
CVE-2026-108706
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...
EUVD-2026-96702
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...
CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...
CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...
CVE-2026-108706
The eladmin framework (up to commit 55fbf70 ) is vulnerable to a missing authorization flaw in the downloadS3Storage handler. This allows any authenticated user to retrieve stored object URLs without the necessary storage permissions by enumerating sequential IDs against the GET /api/s3Storage/do...
CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...
PT-2026-109997
Name of the Vulnerable Software and Affected Versions eladmin versions prior to commit 55fbf70 Description A missing authorization issue exists in the downloadS3Storage handler. This allows any authenticated user to retrieve stored object URLs even if they lack the necessary storage permissions. ...
CVE-2026-108706: Missing Authorization
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...
PT-2026-91024
A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read model of the file fedml/core/distributed/communication/s3/remote storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3 key str causes...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-69243 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-69243 Source advisory: OSV:PYSEC-2026-3546...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-69244 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-69244 Source advisory: OSV:PYSEC-2026-3545...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-59881 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-59881 Source advisory: OSV:PYSEC-2026-3547...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-69244 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-69244 Source advisory: OSV:GHSA-CQ5V-8Q36-5273...
guillotina-s3storage (>=1.0.31, <=1.0.34) potentially affected by CVE-2026-69243 via aiohttp (2.3.0a4)
aiohttp PYPI version 2.3.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - guillotina-s3storage =1.0.31, =1.0.34 Source cves: CVE-2026-69243 Source advisory: OSV:GHSA-MFX4-HV73-Q22V...