6978 matches found
CVE-2026-2462
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x
CVE-2026-4270: Improper Protection of Alternate Path
Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions = 0.2.14 and 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To...
Camaleon CMS Vulnerable To Path Traversal Through AWS S3 Uploader Implementation
Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-1776
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-27142 vulnerabilities
Vulnerabilities for packages: cluster-autoscaler, kaf, kubernetes-csi-external-provisioner, runc, spicedb, terraform-provider-azuread, gogatekeeper, crossplane-provider-aws-lambda, kube-metrics-adapter, kyverno, azure-service-operator, spire-controller-manager, opencost,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: cluster-autoscaler, kaf, kubernetes-csi-external-provisioner, runc, spicedb, terraform-provider-azuread, gogatekeeper, crossplane-provider-aws-lambda, kube-metrics-adapter, kyverno, azure-service-operator, spire-controller-manager, opencost,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: atlantis-fips, minio-object-browser, thanos-receive-controller, spqr, prometheus-elasticsearch-exporter, keda, rancher, harbor-registry-fips, gomplate, listmonk, authentik, crossplane-provider-aws-s3-fips, kyverno, skopeo, terraform-provider-grafana, kubescape,...
EUVD-2026-10361
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
EUVD-2026-10362
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-1776
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation
Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-1776: Improper Limitation of a Pathname to a Restricted Directory
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
Directory Traversal
Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Directory Traversal via the downloadprivatefile function when the application is configured to use the...
CVE-2026-1776
Camaleon CMS CVE-2026-1776 affects versions 2.4.5.0–2.9.0 prior to commit f54a77e, with a path traversal vulnerability in the CamaleonCmsAwsUploader AWS S3 backend. Authenticated users can trigger download_private_file to bypass path validation (valid_folder_path?) and read arbitrary files on the...
CVE-2026-1776 Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-1776
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-1776
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
airflow-aws-shared-secrets (>=0.0.1, <=0.0.5), airflow-tools (>=0.1.0, <=0.8.6) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (8.29.0)
apache-airflow-providers-amazon PYPI version 8.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-aws-shared-secrets =0.0.1, =0.1.0, =0.8.6 Source cves: CVE-2026-25604 Source advisory:...
GHSA-RV5F-CCPM-XJJ4 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...
CVE-2026-25604
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...