org.apache.hugegraph:hg-pd-dist (1.5.0), org.apache.hugegraph:hg-pd-service (1.5.0) +1 more potentially affected by CVE-2025-26866 via org.apache.hugegraph:hg-pd-core (1.5.0)

org.apache.hugegraph:hg-pd-core MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hugegraph:hg-pd-core and may be impacted: - org.apache.hugegraph:hg-pd-dist 1.5.0 - org.apache.hugegraph:hg-pd-service 1.5.0 -...

CVE-2025-26866

creationtimestamp| type| source ---|---|--- 2025-12-09 13:29:50+00:00| seen| https://seclists.org/oss-sec/2025/q4/255 2025-12-09 14:39:08+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m7krjwqpdi2y 2025-12-12 10:01:24+00:00| seen|...

PT-2025-50223

Name of the Vulnerable Software and Affected Versions Apache HugeGraph-Server versions prior to 1.7.0 Description A remote code execution issue exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict...