aleph

.. epigraph:: Truth cannot penetrate a closed mind. If all places in the universe are in the Aleph, then all stars, all lamps, all sources of light are in it, too. -- The Aleph , Jorge Luis Borges ⚠️ PROJECT STATUS: SUNSETTING ⚠️ Our involvement with this open-source project is being sunsetted...

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111696

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111696 data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

EUVD-2026-102986

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

EUVD-2026-102987

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111696

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111695

The Shaiwz data-platform-open software (through commit efeacd3 ) contains an Insecure Direct Object Reference (IDOR) vulnerability in its Datasource API. Authenticated workspace members can access datasources belonging to other workspaces by providing foreign sequential numeric IDs. Specifically,...

CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111696

The data-platform-open application (through commit efeacd3 ) is vulnerable to a hardcoded AES key issue in the AesPasswordEncAndDecServiceImpl component. This use of a publicly known default key allows authenticated attackers to decrypt stored datasource passwords. Attackers can retrieve cipherte...

PT-2026-116094

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

PT-2026-116095

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-83870

The Windows Aggregated Data Platform Service is susceptible to an out-of-bounds read vulnerability (CWE-125). This flaw allows an authorized attacker to perform a local information disclosure , potentially exposing sensitive data. The vulnerability has a CVSS 3.1 base score of 5.5 (Medium). No sp...

Microsoft Windows: CVE-2026-83870: Windows Aggregated Data Platform Service Information Disclosure Vulnerability

Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally...

Release Information for Veeam Recovery Orchestrator 13 and Updates

Veeam Recovery Orchestrator 13 Releases 13.1.0.483 2026-07-29 Embedded component versions: Veeam Backup & Replication 13.1.0.411, Veeam ONE 13.1.0.7034 Release Notes What's New 13.0.3.26 2026-08-28 Embedded component versions: Veeam Backup & Replication 13.0.3.63, Veeam ONE 13.0.2.7159 Release...

Potential access to sensitive URLs via CKAN extensions (SSRF)

ImpactThere are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents e.g. pushing to the DataStore, streaming contents or saving a local cop...

CVE-2026-47386

CVE-2026-47386 affects NocoDB’s OAuth token-exchange flow. Before 2026.05.1, two concurrent token-exchange requests could use the same OAuth authorization code to mint two valid token pairs, breaking PKCE’s single-use guarantee. The issue is mitigated by a fix in 2026.05.1, which introduces atomi...

EUVD-2023-60595

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data using man in the middle techniques...

Cisco HyperFlex HX Data Platform - Remote Command Execution

Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-1498 info: name: Cisco HyperFlex HX Data Platform - Remote Command Executio...