CVE-2026-70667

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:16+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f 2026-08-19 08:31:37+00:00| seen| https://gist.github.com/alon710/db3f4019c2372dbb6dfede560d6093f7...

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vulnerability Details File: go/vt/vttablet/tabletmanager/vreplication/vrlog.go Summary vttablet's /debug/vrlog HTTP endpoint streams live VReplication event data — including the literal SQL DML statements being replicated by MoveTables, Reshard, Materialize, and "vitess"-strategy Online DDL...

AZL-96770 CVE-2026-65959 affecting package vitess for versions less than 19.0.4-13

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-65959

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-65959

In Vitess 24.0.2 and earlier, the /debug/vrlog endpoint in vrlog.go calls vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote attacker reaching the vttablet debug HTTP port can stream live VReplication SQL statements and bound application...

CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

EUVD-2026-61106

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

PT-2026-77268

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 24.0.3 Description The /debug/vrlog endpoint, registered by the addHttpEndpoint function in go/vt/vttablet/tabletmanager/vreplication/vrlog.go, invokes vrlogStatsHandler without performing the required access check via...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102124)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102124 advisory. In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix warning when deleting uninitialized timer With CONFIGDEBUGOBJECTSTIMERS...

Linux Distros Unpatched Vulnerability : CVE-2026-72037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: lan743x: Initialize ethsyslock spinlock before use lan743xhardwareinit calls pci11x1xstrapgetstatus during the PCI11x1x probe sequence. That helper acquire...

Linux Distros Unpatched Vulnerability : CVE-2026-72090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then...

Linux Distros Unpatched Vulnerability : CVE-2026-72076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the...

CVE-2026-72090

A flaw was found in the Linux kernel's amdxdna graphics acceleration driver. A local user could exploit an incorrect client handling issue within the amdxdnadrmsyncboioctl function. When performing a SYNCDIRECTFROMDEVICE operation, the amdxdnahwctxsyncdebugbo function is called with an incorrect...

CVE-2026-75480

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

EUVD-2026-60392

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

CVE-2026-75480

OpenViking's debug vector scroll and count endpoints in viking_vector_index_backend.py use account-level scoping without per-user access controls, allowing any authenticated user to read private memories, resources, skills, and secret material belonging to co-tenants. CVSS 6.5; exploitation in th...

CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...