CVE-2026-48768 TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any...

Sonatype Nexus Repository Information Disclosure Vulnerability

Sonatype Nexus Repository is a repository manager from Sonatype USA. It is mainly used for managing, storing, and distributing software, among other things. An information disclosure vulnerability exists in Nexus Repository version 3.26.1. An attacker with administrative user privileges could...