PYSEC-2026-3685 mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...

vulnerabilities in Oracle MySQL

Oracle has identified vulnerabilities in Oracle MySQL Cluster and Oracle MySQL Connector/ODBC. Versions of Oracle MySQL Cluster from 8.0.0 to 8.0.48, 8.4.0 to 8.4.11, and 9.7.0 to 9.7.2 contain vulnerabilities that allow unauthorized external attackers to cause denial of service through network...

BIT-ELASTICSEARCH-2026-72678 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to...

CVE-2026-76348: Missing Authorization

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege listsearchheadclustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a...

PT-2026-78505

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.9.0 through 4.14.4 Wazuh versions 5.0.0-beta1 and earlier Description The cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to cause memory exhaustion on the master node. The recei...

PT-2026-78513

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process files from worker in framework/wazuh/core/cluster/master.py trusts a peer-controlled file path key from files metadata.json. The...

CVE-2026-76347: Server-Side Request Forgery (SSRF)

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery SSRF in report notifications to send system-authenticated...

CVE-2026-48162: External Control of File Name or Path

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-44253: Memory Allocation with Excessive Size Value

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr method...

PT-2026-78561

Name of the Vulnerable Software and Affected Versions search-v2-operator affected versions not specified Description An issue exists where the operator's ClusterRole is granted permissions equivalent to a cluster administrator. This allows the operator to impersonate other entities, write...

PT-2026-78504

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions 4.0.0 through 4.14.4 Description A low-privilege read-only API user with manager:read permission can retrieve the cluster key from the ossec.conf element via the 'GET /manager/configuration?raw=true' endpoint. An attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-18691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used...

CVE-2026-46343: Improper Limitation of a Pathname to a Restricted Directory

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.endreceivingfile in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUHPATH. A syniwme request wi...

PT-2026-78772

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description A user with a high-privilege role capable of managing search head clustering can exploit the search head cluster member bundle REST API to write files to locations accessible by the...

PT-2026-78775

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with a role containing the high-privilege list searc...

PT-2026-78510

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end receiving file in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH PATH. A syn i w m e...

PT-2026-78547

Name of the Vulnerable Software and Affected Versions Multicluster Engine for Kubernetes affected versions not specified Description A flaw in the cluster-proxy-addon component allows an unauthenticated attacker with access to the user-facing route to bypass authentication and authorization check...

CVE-2026-14514: Allocation of Resources Without Limits or Throttling

IBM Reliable Scalable Cluster Technology RSCT 3.0 could allow a remote attacker to cause a denial of service by sending a specially crafted request due improper input validation...

CVE-2026-76345: Improper Access Control

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer REST API to write files to locations that the user account running Splunk Enterprise can writ...