CVE-2026-45807 Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard onl...

CVE-2026-50137

Budibase prior to 3.39.0 is affected by CVE-2026-50137: unauthenticated POST /api/attachments/:datasourceId/url allows anonymous callers to mint 15-minute AWS S3 pre-signed PUT URLs using the datasource’s IAM credentials, with the bucket not pinned to the datasource. The attack discloses the targ...

CVE-2026-50137 Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...

EUVD-2026-39913

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...

CVE-2026-50137

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...

CVE-2026-50137

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...

EUVD-2026-39912

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require...

CVE-2026-50136

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require...

CVE-2026-12411

creationtimestamp| type| source ---|---|--- 2026-06-26 19:55:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7pzez34222 2026-07-15 00:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnghcoj4l25 2026-11-05 21:30:55+00:00| seen|...

CVE-2026-45408

creationtimestamp| type| source ---|---|--- 2026-06-26 18:19:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7kmzy3za2c 2026-06-28 05:06:57+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpd7btxcpw2h 2026-06-30 01:07:07+00:00| seen|...

CVE-2026-57915

creationtimestamp| type| source ---|---|--- 2026-06-26 18:01:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mp7jmkg4ps23 2026-06-27 19:40:02+00:00| seen| https://bsky.app/profile/canartuc.com/post/3mpc7m3lt342p...

CVE-2026-56067

creationtimestamp| type| source ---|---|--- 2026-06-26 17:55:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7jbvjreo26...

CVE-2026-57658

creationtimestamp| type| source ---|---|--- 2026-06-26 17:50:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7iyw7ru62c...

CVE-2026-56070

creationtimestamp| type| source ---|---|--- 2026-06-26 17:42:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7ikigsze2x...

CVE-2025-60464

creationtimestamp| type| source ---|---|--- 2026-06-26 17:36:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mp7i7rohct2t...

CVE-2026-57644

creationtimestamp| type| source ---|---|--- 2026-06-26 17:18:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7hamu34j27 2026-07-05 08:16:31+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpv55are6d22...

CVE-2026-57642

creationtimestamp| type| source ---|---|--- 2026-06-26 17:17:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7h5s5m7g27 2026-07-06 07:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpxk6fmbje24...

CVE-2026-57662

creationtimestamp| type| source ---|---|--- 2026-06-26 17:15:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7h33vnsu2q 2026-06-30 07:17:24+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpihiwfvug2i...

CVE-2016-5062

creationtimestamp| type| source ---|---|--- 2026-06-26 17:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp7glqfll32g...

Malicious code in xrblocks-remote-control (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e20199ccf4c5557bf9d6bd0f17f0f74b47aa54389f22247523fb9145ef29def Package xrblocks-remote-control ships a bin script that, when invoked including via npx or unintended resolution against the xrblocks name, POSTs the...