1225 matches found
CVE-2026-63080 Aptabase SQL Injection via ClickHouse query backend
Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...
PT-2026-62114
Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...
CVE-2026-63080: Improper Neutralization of Special Elements used in an SQL Command
Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...
CVE-2026-63731
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...
CVE-2026-63731
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...
CVE-2026-63731
HyperDX is affected: a server-side request forgery (SSRF) in HyperDX
EUVD-2026-46067
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...
CVE-2026-63731 HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...
CVE-2026-63731 HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...
CVE-2026-63731 HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...
PT-2026-61690
Name of the Vulnerable Software and Affected Versions HyperDX versions prior to 2.31.0 Description Authenticated team members can perform a server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended destination. By providing a caller-controlled...
CVE-2026-63731: Server-Side Request Forgery (SSRF)
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...
airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-46764 via apache-airflow (2.5.3)
apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-46764 Source advisory:...
airflow-add-ons (0.2.9b1), airflow-clickhouse-plugin (0.8.2) +1 more potentially affected by CVE-2026-46764 via apache-airflow (2.3.4)
apache-airflow PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-add-ons 0.2.9b1 - airflow-clickhouse-plugin 0.8.2 - armada-airflow =0.1.0, =0.2.0 Source cves: CVE-2026-46764 Source advisor...
acryl-datahub-airflow-plugin (>=0.10.5.2rc3, <=0.11.0), airflow-clickhouse-plugin (>=0.11.0, <=1.0.0.post0) potentially affected by CVE-2026-46764 via apache-airflow (2.6.3)
apache-airflow PYPI version 2.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - acryl-datahub-airflow-plugin =0.10.5.2rc3, =0.11.0, =1.0.0.post0 Source cves: CVE-2026-46764 Source advisory: OSV:PYSEC-2026-2354...
airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2026-46764 via apache-airflow (1.10.6)
apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2026-46764...
airflow-clickhouse-plugin (>=0.9.0, <=0.9.1), bigeye-airflow (>=0.1.20, <=0.1.21) +3 more potentially affected by CVE-2026-46764 via apache-airflow (2.4.3)
apache-airflow PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.9.0, =0.1.20, =2.4.3, =2.4.3.4 Source cves: CVE-2026-46764 Source advisory: OSV:PYSEC-2026-2354...
airflow-clickhouse-plugin (0.6.0), dataverk-airflow (>=0.3.18, <=0.3.23) +1 more potentially affected by CVE-2026-46764 via apache-airflow (2.0.2)
apache-airflow PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 0.6.0 - dataverk-airflow =0.3.18, =11.8.0, =13.7.0 Source cves: CVE-2026-46764 Source advisory:...
airflow-add-ons (0.2.9b1), airflow-clickhouse-plugin (0.8.2) +1 more potentially affected by CVE-2026-42358 via apache-airflow (2.3.4)
apache-airflow PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-add-ons 0.2.9b1 - airflow-clickhouse-plugin 0.8.2 - armada-airflow =0.1.0, =0.2.0 Source cves: CVE-2026-42358 Source advisor...