PT-2026-107279

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package contains improper input validation within cloud storage URL readers. An attacker possessing write access to a cloud storage bucket utilized by the framework...

CVE-2026-94204

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, a...

CVE-2026-96587

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...

CVE-2026-96587 Use of Hard-coded Credentials in Viidure Dashcam Android Application

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...

EUVD-2026-89458

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...

CVE-2026-96587

The Viidure Dashcam Android application contains a critical vulnerability where permanent, plaintext cloud storage credentials are embedded within its compiled code. This flaw allows unauthorized entities to gain full access to critical platform storage, enabling them to read, modify, or delete o...

CVE-2026-94204 Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, a...

CVE-2026-94204

The Viidure Dashcam Android Application suffers from a critical misconfiguration where the central cloud storage backend is assigned public-read permissions . This flaw allows anyone on the internet unrestricted access to the shared storage bucket, exposing sensitive user records , live dashcam f...

CVE-2026-94204: Incorrect Permission Assignment for Critical Resource

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, a...

PT-2026-102915

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, a...

PT-2026-102917

Name of the Vulnerable Software and Affected Versions Viidure Android application affected versions not specified Description The application embeds permanent, plaintext cloud storage credentials within its compiled code. This allows unauthorized full access to critical platform storage, enabling...

CVE-2026-96587: Use of Hard-coded Credentials

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...

CVE-2026-81862: Insertion of Sensitive Information into Log File

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...

BIT-PARSE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

PT-2026-99008

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

CVE-2026-63373: Cross-Site Request Forgery (CSRF)

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

s3dns v0.2.30

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

EUVD-2026-78210

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...