CVE-2026-90614

FedML-AI FedML versions up to 0.9.6 contain a deserialization vulnerability in the MQTT+S3 Communication Backend component. The flaw resides in the S3Storage.read_model function within fedml/core/distributed/communication/s3/remote_storage.py, where manipulation of the s3_key_str argument trigger...

EUVD-2026-77169

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...

CVE-2026-90614 FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...

CVE-2026-90614 FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...

PT-2026-91024

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read model of the file fedml/core/distributed/communication/s3/remote storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3 key str causes...

PT-2026-89500

Name of the Vulnerable Software and Affected Versions rclone versions 1.70.0 through 1.75.0 Description The serve/start RC interface allows per-server configuration via a proxyOpt object. However, the FTP and S3 server constructors incorrectly validate the process-global proxy.Opt.AuthProxy value...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...