8339 matches found
CVE-2026-4270
CVE-2026-4270 affects AWS API MCP Server (versions >= 0.2.14 and
evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)
simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: OSV:PYSEC-2026-132...
CVE-2026-2462
Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and...
CVE-2026-2462
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x
CVE-2026-2462
Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and...
CVE-2026-4270: Improper Protection of Alternate Path
Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions = 0.2.14 and 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To...
Camaleon CMS Vulnerable To Path Traversal Through AWS S3 Uploader Implementation
Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)
simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: GHSA-44VG-5WV2-H2HG...
evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)
simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: SNYK:PYTHON-SIMPLEEVAL-15610288...
evennia (>=1.0.0, <=6.0.0), fastapi-casbin-auth (>=1.3.0, <=1.5.0) +7 more potentially affected by CVE-2026-32640 via simpleeval (>=1.0.0, <=1.0.4)
simpleeval PYPI version =1.0.0, =1.0.0, =1.3.0, =2.8.0, =1.22.1, =3.2.0, =1.0.0, =0.53.6, =0.54.0a10 Source cves: CVE-2026-32640 Source advisory: OSV:GHSA-44VG-5WV2-H2HG...
@backstage/plugin-auth-backend-module-aws-alb-provider (>=0.4.14-next.0, <=0.4.14-next.1), @backstage/plugin-auth-backend-module-oidc-provider (>=0.4.14-next.0, <=0.4.14-next.1) potentially affected by CVE-2026-32236 via @backstage/plugin-auth-backend (>=0.27.1-next.0, <=0.27.1-next.2)
@backstage/plugin-auth-backend NPM version =0.27.1-next.0, =0.4.14-next.0, =0.4.14-next.0, =0.4.14-next.1 Source cves: CVE-2026-32236 Source advisory: SNYK:JS-BACKSTAGEPLUGINAUTHBACKEND-15479717...
CVE-2026-1776
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-27142 vulnerabilities
Vulnerabilities for packages: dex, thanos, knative-eventing, tetragon, mcp-grafana, crossplane-provider-aws-route53, sftpgo-plugin-auth, crossplane-provider-aws-rds, yunikorn-k8shim, promxy, kubernetes-csi-external-attacher, kube-metrics-adapter, cert-manager-cmctl, libnvidia-container, tempo,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: dex, thanos, knative-eventing, tetragon, mcp-grafana, crossplane-provider-aws-route53, sftpgo-plugin-auth, crossplane-provider-aws-rds, yunikorn-k8shim, promxy, kubernetes-csi-external-attacher, kube-metrics-adapter, cert-manager-cmctl, libnvidia-container, tempo,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: cosign-fips, terraform-provider-time, k8ssandra-client-fips, opencost, prometheus-podman-exporter-fips, sftpgo-plugin-eventsearch, thanos-receive-controller-fips, prometheus-process-exporter-fips, vault-csi-provider-fips, cass-operator-fips-no-pvc-delete,...
EUVD-2026-10362
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
EUVD-2026-10361
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-1776
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
CVE-2026-1776: Improper Limitation of a Pathname to a Restricted Directory
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation
Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the downloadprivatefile functionality wh...