PT-2026-78720

Name of the Vulnerable Software and Affected Versions search-indexer affected versions not specified Description A flaw in the delta-sync write paths allows a registered and authenticated managed cluster to tamper with or delete indexed search data belonging to another cluster. This occurs becaus...

CVE-2026-71470: Improper Control of Dynamically-Managed Code Resources

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

PT-2026-78536

Name of the Vulnerable Software and Affected Versions search-v2-operator affected versions not specified Description A flaw in the search-v2-operator allows a privileged user with Custom Resource CR editor permissions to manipulate Search CR fields without proper validation. The affected fields...

CVE-2026-48024: Improper Limitation of a Pathname to a Restricted Directory

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...

PT-2026-78780

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can delete arbitrary...

CVE-2026-66794: Server-Side Request Forgery (SSRF)

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

CVE-2026-44252: Incorrect Authorization

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...

PT-2026-80657

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectl get, kubectl describe, kubectl delete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers...

Oracle MySQL Cluster 9.x < 9.7.3 (August 2026 CSPU)

The versions of MySQL Cluster installed on the remote host are affected by a vulnerability as referenced in the August 2026 CSPU advisory. - Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.0-8.0.48, 8.4.0-8.4.11...

Oracle MySQL Cluster 8.0.x < 8.0.49 (August 2026 CSPU)

The versions of MySQL Cluster installed on the remote host are affected by a vulnerability as referenced in the August 2026 CSPU advisory. - Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.0-8.0.48, 8.4.0-8.4.11...

Oracle MySQL Cluster 8.4.x < 8.4.12 (August 2026 CSPU)

The versions of MySQL Cluster installed on the remote host are affected by a vulnerability as referenced in the August 2026 CSPU advisory. - Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.0-8.0.48, 8.4.0-8.4.11...

CVE-2026-76827: Protection Mechanism Failure

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

Linux Distros Unpatched Vulnerability : CVE-2026-18691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used...

CVE-2026-70724

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.0-8.0.48, 8.4.0-8.4.11 and 9.7.0-9.7.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Cluster...

CVE-2026-70717

Vulnerability in Oracle Autonomous Health Framework component: Cluster Health Analyzer. Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attach...

CVE-2026-60592

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: NDB Operator. Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromi...

EUVD-2026-61679

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.0-8.0.48, 8.4.0-8.4.11 and 9.7.0-9.7.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Cluster...

EUVD-2026-61672

Vulnerability in Oracle Autonomous Health Framework component: Cluster Health Analyzer. Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attach...

EUVD-2026-61392

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: NDB Operator. Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromi...

CVE-2026-74046

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...