CVE-2026-52794

Sentry CVE-2026-52794 describes a ReDoS in the event ingestion pipeline affecting versions from 24.4.0 through 26.5.2, where a regex on attacker-controlled fields can cause excessive CPU time. The flaw has a CVSSv3.1 base score of 7.5 (High) with network attack vector and no privileges required. ...

PT-2026-52105

Name of the Vulnerable Software and Affected Versions Sentry versions 24.4.0 through 26.5.1 Description A Regular Expression Denial of Service ReDoS exists in the event ingestion pipeline. This occurs when a regular expression is applied to attacker-controlled fields on incoming events, allowing...

GHSA-VQ2F-VCC9-J8MV vulnerabilities

Vulnerabilities for packages: datahub-ingestion...

CVE-2026-54911 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, openstack-horizon-2026.1-fips, openstack-placement-2025.2, openstack-keystone-2025.1-fips, openstack-placement-2025.1-fips, openstack-keystone-2025.2, openstack-glance-2025.2, openstack-glance-2025.2-fips, openstack-glance-2025.1-fips,...

CVE-2026-55865 vulnerabilities

Vulnerabilities for packages: datahub-ingestion...

GHSA-3J69-69WJ-XQX2 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, openstack-horizon-2026.1-fips, openstack-placement-2025.2, openstack-keystone-2025.1-fips, openstack-placement-2025.1-fips, openstack-keystone-2025.2, openstack-glance-2025.2, openstack-glance-2025.2-fips, openstack-glance-2025.1-fips,...

GHSA-FFM6-VVPH-G5F5 OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature

Summary The OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration allowAbsoluteUrls: true. This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios wil...

EUVD-2026-11599

OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature...

CVE-2026-46481

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

CVE-2026-46481 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

CVE-2026-46481

OpenMetadata 1.12.1 is affected by a vulnerability in the TEST_CONNECTION workflow (POST /api/v1/automations/workflows) where a non-admin SSO user can trigger a TEST_CONNECTION and receive both the cleartext database password in the response and a valid ingestion-bot JWT in openMetadataServerConn...

CVE-2026-46481 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

CVE-2026-46481

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

EUVD-2026-35136

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

CVE-2026-46481 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

Denial of Service (DoS)

Overview bugsink is a Self-hosted Error Tracking Affected versions of this package are vulnerable to Denial of Service DoS through the ingestion process. An attacker can cause the application to become temporarily unavailable to other users by submitting an event containing an unusually large...

GHSA-5X67-J5XG-C5GJ Bugsink: DOS using large numbers of event tags

Summary In affected versions, Bugsink stores every tag supplied with an incoming event. An event with an unusually large number of custom i.e. supplied by an attacker tags can therefore make ingestion spend more time than intended writing tag rows. Bugsink uses a single-writer database...

CVE-2026-2652

A flaw was found in mlflow. When the mlflow server is configured with basic authentication and served via uvicorn, an architectural mismatch in the FastAPI permission middleware allows unauthenticated remote attackers to bypass authentication on specific routes. This bypass enables attackers to...

TinyIce 访问控制错误漏洞

TinyIce is a streaming server developed by Sylwester that supports multiple protocol inputs and outputs. Versions 0.8.95 to 2.4.1 of TinyIce contain access control vulnerability issues. This vulnerability stems from the lack of authentication for WebRTC ingestion endpoints, which may allow...

PT-2026-49061

Name of the Vulnerable Software and Affected Versions Bugsink versions prior to 2.2.2 Description Bugsink stores every tag provided with an incoming event. An attacker can submit an event containing an unusually large number of custom tags, causing the ingestion process to spend excessive time...