CVE-2026-120308: beam-cloud: A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue

A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...

PT-2026-134903

Name of the Vulnerable Software and Affected Versions Beam Cloud Beta9 Gateway versions prior to 0.1.776 Beam Cloud Beta9 Worker versions prior to 0.1.756 Description An issue exists where a tenant with a workspace token can attach a volume when deploying a function, endpoint, or task queue. The...

CVE-2026-11853

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages .dsc and upload artifacts .changes are manifest files that name the files that make up the artifact. The parser used to read these files in Debusine accepted arbitrary fully...

EUVD-2026-35999

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages .dsc and upload artifacts .changes are manifest files that name the files that make up the artifact. The parser used to read these files in Debusine accepted arbitrary fully...

PT-2026-48397

Name of the Vulnerable Software and Affected Versions Debusine affected versions not specified Description Debusine uses a parser to read Debian source packages .dsc and upload artifacts .changes, which are manifest files listing the components of an artifact. This parser accepts arbitrary paths...