592 matches found
Vendure - Arbitrary File Read
Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...
CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint
TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...
CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint
TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...
CVE-2026-54457
TensorZero (open-source LLMOps platform) is vulnerable to arbitrary file read and SSRF via its Gateway /internal/object_storage endpoint in versions prior to 2026.6.0 . The endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration...
EUVD-2026-39535
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access...
CVE-2026-73265 RustFS: Version-specific object reads authorize the non-version action
RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known...
CVE-2026-73265 RustFS: Version-specific object reads authorize the non-version action
RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known...
PT-2026-71093
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy allowed path applies deny anonymo...
CVE-2026-68159
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...
CVE-2026-68153
In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...
EUVD-2026-55544
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...
CVE-2026-68158
CVE-2026-68158 (Linux kernel libceph) : A vulnerability in decoding CEPH_MSG_OSD_MAP can overflow when computing the length of the new_state portion, causing an overflowed bounds check and potentially out-of-bounds memory reads during osdmap decoding. The issue arises from a multiplication that m...
CVE-2026-68082 libceph: fix two unsafe bare decodes in decode_lockers()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...
EUVD-2026-54775
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...
CVE-2026-68082
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...
CVE-2026-70559
Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...
CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation
Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...
GHSA-4VR5-P2GC-H23P rclone archive extract allows S3 destination prefix escape via crafted archive paths
Summary rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive. A malicious archive entry containing parent path components such as ../ can escape the requested extraction prefix and create or overwrite sibling objects in th...
CVE-2026-71192
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...
