CVE-2026-106493

A flaw was found in Backstage. Cloud storage catalog providers do not sufficiently validate object paths. An attacker with permissions to create or rename objects in a configured cloud storage source, such as Amazon Web Services AWS S3 or Azure Blob Storage, can cause catalog descriptors to be re...

CVE-2026-106493

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106493

The Backstage framework is vulnerable to a Directory Traversal issue because cloud storage catalog providers for Azure Blob Storage and AWS S3 fail to validate object paths. Specifically, the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts do not check for dot-segment seq...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

PT-2026-107278

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.54.6 Description Cloud storage catalog providers do not sufficiently validate object paths. A principal with permissions to create or rename objects in a configured AWS S3 or Azure Blob Storage catalog source can...

CVE-2026-106493: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

s3dns v0.2.28

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

com.qaprosoft:carina-api (>=6.0.4, <=6.1.24), com.qaprosoft:carina-aws-s3 (>=6.0.4, <=6.1.24) +6 more potentially affected by CVE-2026-63335 via com.rabbitmq:amqp-client (4.9.0)

com.rabbitmq:amqp-client MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.qaprosoft:carina-api =6.0.4, =6.0.4, =6.0.4, =6.0.4, =6.0.4, =6.0.4, =3.3.48, =4.0.58 -...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: redpanda, podinfo, migrate, kbld, emissary, manifest-tool, spire-server, crossplane-provider-aws-route53, crossplane-provider-aws-cloudformation, envoy-gateway, actions-runner-controller, node-problem-detector, wuzz, zarf, cloud-provider-azure, cloud-provider-aws,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, cloudflared, pulumi-language-yaml, terraform-provider-tls, kaf, spire-server, crossplane-provider-aws-route53, crossplane-provider-aws-cloudformation, prometheus-operator, zarf, cloud-provider-aws,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: nri-mongodb, podinfo, kbld, neuvector-sigstore-interface, manifest-tool, nri-f5, spire-server, git-sync, terraform-mcp-server, crossplane-provider-aws-cloudformation, s5cmd, dex, terraform-provider-time, actions-runner-controller, wuzz,...

CVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

PT-2026-71879

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-11976

MonsterInsights Pro updates 10.2.0 and 10.2.2 were distributed from the official update bucket and contain a malicious file, class-system-check.php, due to a compromised AWS S3 bucket. Three distinct variants were observed on 2026-06-11, all using the same AES-256-GCM key, indicating a single thr...

Subdomain takeover AWS S3 Detection

Detects Subdomain takeover AWS S3. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Subdomain takeover AWS S3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Subdomain takeover AWS S3 Detection', 'description':...

org.apache.camel.kafkaconnector:camel-aws-s3-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-aws-sqs-batch-sink-kafka-connector (4.18.0) +9 more potentially affected by CVE-2026-56140 via org.apache.camel:camel-aws2-sqs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-aws2-sqs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-56140 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821197...

org.apache.camel.kafkaconnector:camel-aws-s3-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-aws-sqs-batch-sink-kafka-connector (4.18.0) +9 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-aws2-sqs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46456 Source advisory: GHSA-CMC3-HR79-8MMV...