Malicious code in home-sections-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6c206f8844e1ff870876bc1ac8cdf2b10ee2c36caf61883eb5a8f03caa5405 package.json declares the dependency ltidisafe as a direct tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz hosted on an...

MAL-2026-10419 Malicious code in notifications-broadcast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2 [email protected] ships an empty index.js module.exports = ; with placeholder metadata empty description, empty author, version 99.9.1...

CVE-2026-57856: Improper Limitation of a Pathname to a Restricted Directory

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

PT-2026-57915

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php executes bucket commands ls, upload, removefiles, rename, createfolder without performing any ACL or role check. Any authenticated...

CVE-2026-57855: Improper Access Control

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php executes bucket commands ls, upload, removefiles, rename, createfolder without performing any ACL or role check. Any authenticated...

PT-2026-59163

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to but not including 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictabl...

PT-2026-57916

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg replace'/^a-zA-Z0-9- ./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

Malicious code in polylabel-web-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce7df46acd8236fafbaa27dbccb92d1f286c17b023ea5ff555700e76c4a0188f [email protected] ships an empty index.js stub and declares its only runtime dependency as a direct tarball URL on a Google Cloud Storage...

MinIO Public Bucket Listing Verification

Confirms anonymous ListBuckets or open bucket listing on MinIO/S3 API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify MinIO/S3 anonymous bucket listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlrespon...

ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories

Most security mess starts as admin work. A link gets clicked. A tool gets trusted. A bucket name gets reused. A setting stays loose because nobody wants to touch it. This week is full of that kind of damage. Not loud. Not clever. Just small gaps doing big jobs. The worst part is how normal it all...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the S3Tables / Iceberg REST management API due to improper authorization handling of SigV4-signed requests. An attacker can access administrator-owned table bucket names and ARNs by sending authenticated...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the S3Tables / Iceberg REST management API due to improper authorization handling of SigV4-signed requests. An attacker can access administrator-owned table bucket names and ARNs by sending authenticated...

CVE-2026-55874

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side...

CVE-2026-55874

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side...

CVE-2026-55874 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side...

CVE-2026-55874 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side...

CVE-2026-55874

SeaweedFS's S3 API gateway is affected prior to version 4.34 by a path traversal issue in the X-Amz-Copy-Source header (dot-dot segments) that can enable an authenticated user scoped to one bucket to read objects from other buckets via server-side copy. The issue is documented across CVE-2026-558...

CVE-2026-55874 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side...

PT-2026-56468

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.34 Description The S3 API gateway fails to properly validate input in the X-Amz-Copy-Source header used by the CopyObject and UploadPartCopy functions. This improper validation allows the use of dot-dot path...

archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2026-48588 via django (3.0.8)

django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...