cpra

Continuous Pulse and Recovery Agent 检查服务、发送告警，并执行你配置的恢复操作。 CPRa 是一个用 Go 编写的自托管监控与恢复代理。它按计划对你的服务运行 健康检查，根据可配置的阈值开启和关闭事件，发送通知，并在服务 失败时执行恢复操作——重启容器、调用 webhook、重启或扩缩 Kubernetes 工作负载、重启 EC2 实例、重启 systemd 单元。它以单个服务器二进制文件的形式发布，内置只读仪表盘、 HTTP API 以及 cpractl 命令行客户端。它采用 MIT 许可。 文档： ziad-hsn.github.io/cpra —...

PT-2026-102820

Name of the Vulnerable Software and Affected Versions metatool-ai MetaMCP versions 2.4.22 and earlier Description An insecure direct object reference IDOR exists in the MCP transport session dispatch. The session store, specifically the getSession function in session-lifetime-manager.ts, relies...

CVE-2026-97553

A flaw was found in the Linux kernel's XFS file system. When unmounting a file system, the health monitoring subsystem fails to acquire the necessary lock before inserting an unmount event into the event list. A local user with permissions to unmount file systems could trigger this race condition...

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

CVE-2026-84712

A flaw in the automation-controller API allows an unauthenticated attacker to access the /api/v2/ping/ health-check endpoint. This endpoint over-serializes RBAC-gated automation-mesh data into an anonymous response, exposing the full instance inventory, including node hostnames, types, UUIDs, hea...

EUVD-2026-85609

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path

A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication,...

EUVD-2026-80998

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the inflate payload processing path. An attacker can exhaust memory or trigger severe garbage-collection pressure by supplying a Smart Health Card JWT with a zip":"DEF"...

EUVD-2026-81275

TCH QRing smart ring model R20B006 running firmware RT09R201.00.00250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service...

CVE-2026-89034 TCH QRing R20_B006 Unauthenticated BLE Access

TCH QRing smart ring model R20B006 running firmware RT09R201.00.00250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service...

CVE-2026-81875 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

CVE-2026-81876: Improper Input Validation

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Car...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always stop the health timer during driver removal Currently, if teardownhca fails to execute during driver removal, mlx5 does not stop the health timer. As a result, mlx5 continues with the driver teardown. This may le...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always drain health during the shutdown callback. There is no point in performing recovery operations during device shutdown. If health-related tasks are initiated, one must wait until they are completed to avoid race...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netdevsim: prevented bad user input in nsimdevhealthbreakwrite. If a zero count or a large number is provided, the kernel may crash...

CVE-2026-75940

A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information...

CVE-2026-75940

Lenovo Health Android Application , distributed exclusively in the Chinese market, has a vulnerability that allows an attacker to access sensitive health-related information over the network. The root cause and specific affected component are not detailed in the provided documents. Lenovo assigne...

CVE-2026-75940

A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information...