111971 matches found
CVE-2026-45807
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard onl...
CVE-2026-53576
creationtimestamp| type| source ---|---|--- 2026-06-26 22:11:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7xlajhsm2c 2026-06-27 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpcar4z6g52m 2026-06-29 19:25:26+00:00| seen|...
EUVD-2026-31691
Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes...
CVE-2026-46604
creationtimestamp| type| source ---|---|--- 2026-06-26 21:50:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wh7n3cg2m 2026-06-29 14:45:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgq3cj5ah2o...
Cargo can be coerced to share credentials between registries
The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the sparse index protocol1. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a...
EUVD-2026-31654
Cargo can be coerced to share credentials between registries...
MAL-2026-6539 Malicious code in db-query-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4928f7d380b79104d997e7666603726873158508c38d2c75a90c7529dd196be3 The package presents itself as a database query helper but index.js defines a method queryDBConnect that base64-decodes a hardcoded URL pointing to...
CVE-2026-50137
Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...
GHSA-RP72-5V5Q-2446 @cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url
Summary @cardano402/mcp-server versions = 0.1.1 ship three security gaps that can lead to unauthorized fund movement when the package is used as designed an MCP server exposing Cardano payment tools to an Impact 1. No spending limits on signed payments An LLM or prompt-injected LLM calling tools...
EUVD-2026-39913
Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...
CVE-2026-50137
Budibase prior to 3.39.0 is affected by CVE-2026-50137: unauthenticated POST /api/attachments/:datasourceId/url allows anonymous callers to mint 15-minute AWS S3 pre-signed PUT URLs using the datasource’s IAM credentials, with the bucket not pinned to the datasource. The attack discloses the targ...
CVE-2026-50137 Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...
CVE-2026-50137
Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...
EUVD-2026-39912
Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require...
CVE-2026-50136
Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require...
CVE-2026-12411
creationtimestamp| type| source ---|---|--- 2026-06-26 19:55:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7pzez34222 2026-07-15 00:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnghcoj4l25...
CVE-2026-45408
creationtimestamp| type| source ---|---|--- 2026-06-26 18:19:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7kmzy3za2c 2026-06-28 05:06:57+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpd7btxcpw2h 2026-06-30 01:07:07+00:00| seen|...
CVE-2026-57915
creationtimestamp| type| source ---|---|--- 2026-06-26 18:01:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mp7jmkg4ps23 2026-06-27 19:40:02+00:00| seen| https://bsky.app/profile/canartuc.com/post/3mpc7m3lt342p...