1532 matches found
CVE-2026-111701
OtterMind Nubase through version 0.1.4 is vulnerable to a missing authentication flaw in the Storage Object API. The vulnerability exists because the endpoint /storage/v1/object/{bucketId}/{path} is incorrectly treated as public for all HTTP methods. Consequently, an unauthenticated attacker who ...
PT-2026-116100
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/bucketId/path is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object pat...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: dma-debug: fixed a possible deadlock in radixlock. The radixlock function should not be held while holding dmahashentryidx.lock. Otherwise, a deadlock scenario may occur when the dma debug API is called while holding rqlock...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nfconntrack: A crash occurred when attempting to remove an uninitialized entry from the hash bucket list. A crash occurred while trying to remove the conntrack entry from the hash bucket list: Exception RIP:...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: BPF: Fixed a memory leak in the LRU and LRUPERCPU hash maps The LRU and LRUPERCPU maps allocate a new element during updates, before locking the target hash table bucket. Immediately afterwards, the maps attempt to lock the bucke...
Authorization Bypass
Payload CMS is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control and file validation when handling client uploads across multiple collections sharing an S3 bucket, which allows an authenticated attacker to overwrite existing objects belonging to another...
UBUNTU-CVE-2026-109741
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109741
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-110310
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...
EUVD-2026-101618
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...
CVE-2026-108597
A flaw was found in cohere. An attacker with write permissions to an associated Amazon Simple Storage Service S3 bucket can supply a specially crafted model archive containing directory traversal sequences. When the application extracts the archive without validating member file paths, arbitrary...
SUSE CVE-2026-109741
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
PT-2026-114031
Name of the Vulnerable Software and Affected Versions S3 .NET Encryption Client versions prior to 3.2.2 S3 .NET Encryption Client versions prior to 4.0.3 Description A padding oracle flaw exists in the S3 .NET Encryption Client. A remote user with read access to encrypted objects in an S3 bucket...
CVE-2026-103965 Fixed values in MongoDB Server $bucket stage may be misread as field references
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return...
CVE-2026-103965
The MongoDB Server aggregation framework contains a vulnerability where certain constant values are handled incorrectly during internal query rewriting. Specifically, fixed values in the $bucket stage may be misread as field references . This flaw allows an authenticated user with read access to ...
DEBIAN-CVE-2026-109741
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109741
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
EUVD-2026-98503
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...
CVE-2026-109741
A Use-after-free vulnerability exists in the Storage: Bucket File System component. This flaw affects Firefox , Firefox ESR , and Thunderbird . The vulnerability has been addressed in Firefox 158 , Firefox ESR 153.5 , Thunderbird 158 , and Thunderbird 153.5 . No specific exploit details or in-the...
