remote-control

Control remoto para Laravel Otorga acceso remoto a la cuenta de usuario sin compartir credenciales. Instalación Configuración Usos Enrutamiento Creación de acceso remoto Uso del token de acceso generado Instalación Remote Control puede instalarse mediante composer: composer require...

CVE-2026-54356

CVE-2026-54356 — Budibase: emisión autenticada de URL de carga firmada de S3 arbitraria Un usuario autenticado de bajo privilegio rol BASIC de un espacio de trabajo de Budibase publicado puede llamar a POST /api/attachments/:datasourceId/url y obtener una URL de carga pre-firmada de S3 firmada co...

CVE-2026-86481

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...

CVE-2026-86481

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...

CVE-2026-86481

JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in which signed URL reuse allowed disclosure of restricted project icons . The underlying cause is the reuse of signed URLs, enabling an authenticated low-privilege user to access project icon resources that should re...

CVE-2026-86481

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...

EUVD-2026-72497

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...

PT-2026-86853

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...

CVE-2026-86481: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...

EUVD-2026-60382

Budibase authenticated arbitrary S3 signed upload URL issuance via /api/attachments/:datasourceId/url...

Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

GHSA-6X9P-4R67-5GJX Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

GO-2026-6287 Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/cloudreve/Cloudreve

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached contexthint in github.com/cloudreve/Cloudreve...

GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

CVE-2026-54356

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

CVE-2026-54356

Budibase's POST /api/attachments/:datasourceId/url endpoint (CWE-862, missing authorization) lets a low-privilege authenticated user mint S3 pre-signed PutObject URLs using the org's stored datasource credentials for attacker-controlled bucket/key values. The route only checks generic table-write...

CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...