670 matches found
Vendure - Arbitrary File Read
Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...
bucketbuster
BucketBuster Cloud object-storage exposure scanner and read-only storage CLI for authorized security testing, bug bounty work, and infrastructure you own. BucketBuster checks candidate bucket names against public endpoints for Yandex Cloud, VK Cloud, Selectel, SberCloud, Alibaba OSS, Tencent COS,...
CVE-2026-110108
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName...
CVE-2026-110108 MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName...
CVE-2026-110108 MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName...
CVE-2026-110108
MateCloud versions through 5.0.8 are affected by a missing authorization vulnerability within the StorageController . This flaw allows any authenticated user, including low-privilege or self-registered accounts, to interact with unprotected /api/1/admin/storage endpoints. By supplying arbitrary b...
oss
oss δΈζ | English A cross-cloud object storage CLI based on the S3 protocol. One binary for all major providers: AWS S3, Aliyun OSS, Tencent COS, Huawei OBS, Baidu BOS, Kingsoft KS3, UCloud US3, JD Cloud OSS, Google Cloud Storage, Cloudflare R2, Scaleway, Wasabi, DigitalOcean Spaces, Yandex,...
CVE-2026-110108: Missing Authorization
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName...
CVE-2026-108654
JeecgBoot versions up to and including 3.9.5 are affected by a missing authorization vulnerability in the OssFileController queryById handler. This flaw allows low-privileged authenticated users to access records belonging to other users by requesting GET /sys/oss/file/queryById with a known reco...
CVE-2026-108654 JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...
CVE-2026-108654 JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...
CVE-2026-108654: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...
@fdm-monster/server (>=2.0.11, <=2.1.1), @objectif-lune/node-red-contrib-ftp (>=1.1.0, <=1.2.0) +2 more potentially affected by CVE-2026-102990 via basic-ftp (>=6.0.1, <=6.2.0)
basic-ftp NPM version =6.0.1, =2.0.11, =1.1.0, =1.0.0, =2.0.3-beta, =2.1.4-1257-beta.1 Source cves: CVE-2026-102990 Source advisory: OSV:GHSA-C475-QRG2-PJ4R...
@fdm-monster/server (>=2.0.11, <=2.1.1), @objectif-lune/node-red-contrib-ftp (>=1.1.0, <=1.2.0) +2 more potentially affected by CVE-2026-102990 via basic-ftp (>=6.0.1, <=6.2.0)
basic-ftp NPM version =6.0.1, =2.0.11, =1.1.0, =1.0.0, =2.0.3-beta, =2.1.4-1257-beta.1 Source cves: CVE-2026-102990 Source advisory: GHSA-C475-QRG2-PJ4R...
MinIO DoS
The vulnerability of the MinIO object storage server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...
MinIO Privilege Escalation
The vulnerability of the MinIO object storage server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to increase their privileges...
MinIO Privilege Escalation
The vulnerability of the MinIO object storage server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to increase their privileges...
Release Information for Veeam Backup for Microsoft 365 8.6
Requirements This release can be used to: upgrade an existing v8, v8.1, v8.2, v8.3, v8.4, or v8.5 deployment of Veeam Backup for Microsoft 365 to v8.6. install a new deployment of Veeam Backup for Microsoft 365 v8.6. After installing this release, the Veeam Backup for Microsoft 365 build number...
EUVD-2026-72107
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...
CVE-2026-32637
A flaw was found in Velero, an open-source tool for managing Kubernetes backups. An attacker who compromises the backup object-storage backend can upload a specially crafted malicious backup file. During the restore process, this malicious file can exploit a path traversal vulnerability to...