CVE-2026-54917-SeaweedFS-Cross-Bucket-Traversal

CVE-2026-54917 — SeaweedFS S3 网关跨存储桶路径遍历 CVE-2026-54917 的概念验证与技术解析，这是 SeaweedFS S3 API 网关中的一个路径遍历漏洞，可让调用者访问任意存储桶 中的对象，无论其凭据被授权访问哪些存储桶。 | ---|--- CVE| CVE-2026-54917 安全公告| GHSA-w62w-66v9-vvgv 产品| SeaweedFS — S3 API 网关（weed s3，以及 weed server 中的 S3 端点） 受影响版本| 4.30 已修复版本| 4.30 弱点| CWE-22 —...

krustyloader-analysis

Análisis de KrustyLoader Este repositorio contiene recursos relacionados con el análisis realizado sobre KrustyLoader y disponible en esta publicación de blog: https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises. un script de Python para...

aws-perimeter

aws-perimeter 一个基于终端的 AWS 安全扫描器 ，包含 100+ 项安全检查 ，覆盖 VPC、IAM、S3、CloudTrail、容器（ECS/EKS）及 AI 攻击检测。可检测危险的 IAM 权限、暴露的密钥、配置错误的 S3 存储桶、容器漏洞以及新兴的 LLMjacking 威胁。 产品概览：docs/CAPABILITIESOVERVIEW.md 功能 🔒 VPC 安全 安全组分析（开放的 SSH/RDP、数据库端口） 公开暴露检测与管理端口风险 网络 ACL 分析与 VPC Flow Log 审计 VPC 对等连接风险、堡垒主机检测 NAT 网关状态与 VPC...

MAL-2026-17419 Malicious code in friendly-tools (PyPI)

friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendlygreeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copi...

oss

oss 中文 |English Herramienta de línea de comandos para almacenamiento de objetos multicloud basada en el protocolo S3. Un solo binario para operar el almacenamiento de objetos de los principales proveedores de nube: AWS S3, Alibaba Cloud OSS, Tencent Cloud COS, Huawei Cloud OBS, Baidu Cloud BOS,...

CVE-2026-97395

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395 Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395

In Apache Polaris versions

EUVD-2026-88960

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395 Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395: Undefined Security Weakness

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

slurp-old

slurp 手动或通过 certstream 枚举 S3 存储桶 概述 首先，感谢 https://github.com/eth0izzle/bucket-stream 提供的 certstream 思路。 同样，感谢所有使此工具成为可能的供应商软件包。 不对您如何使用此工具负责。 模式 Certstream 域名 关键词 特性 使用 Go 编写： 比 Python 更快。 没有依赖地狱和版本锁定（例如 Python 3 和 requirements.txt 等）；更易于部署、静态二进制等。 更好的并发性。 支持国际化域名的 Punycode（S3...

CVE-2026-54356

CVE-2026-54356 — Budibase: emisión autenticada de URL de carga firmada de S3 arbitraria Un usuario autenticado de bajo privilegio rol BASIC de un espacio de trabajo de Budibase publicado puede llamar a POST /api/attachments/:datasourceId/url y obtener una URL de carga pre-firmada de S3 firmada co...

BIT-PARSE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

BIT-SEAWEEDFS-2026-58372 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the...

BIT-RCLONE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

BIT-RCLONE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

PT-2026-99021

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...

PT-2026-99008

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...

PT-2026-99024

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the...