CVE-2025-59360

CVE-2025-59360 concerns Chaos Mesh’s Chaos Controller Manager. The killProcesses mutation (and related mutations like cleanIptables/cleanTcs) is reported vulnerable to OS command injection, enabling unauthenticated in-cluster attackers to perform remote code execution across the Kubernetes cluste...

CVE-2025-59360 OS command injection in Chaos Mesh via the killProcesses mutation

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59360 OS command injection in Chaos Mesh via the killProcesses mutation

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59359

CVE-2025-59359 concerns the Chaos Controller Manager in Chaos Mesh, where the cleanTcs mutation is vulnerable to OS command injection. This is paired with CVE-2025-59358, which describes an unauthenticated GraphQL debugging server that can kill processes across pods, enabling cluster-wide remote ...

CVE-2025-59359 OS command injection in Chaos Mesh via the cleanTcs mutation

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59359 OS command injection in Chaos Mesh via the cleanTcs mutation

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59358 Denial of Service via Unauthorized Access to Chaos Mesh debugging server

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

CVE-2025-59358

The CVE-2025-59358 entry is linked to Chaos Mesh: the Chaos Controller Manager exposes a GraphQL debugging server without authentication, reachable across the Kubernetes cluster. This misconfiguration permits an attacker to access an API capable of killing arbitrary processes in any pod, leading ...

CVE-2025-59358 Denial of Service via Unauthorized Access to Chaos Mesh debugging server

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

CVE-2025-59358 Denial of Service via Unauthorized Access to Chaos Mesh debugging server

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

Chaos Mesh 操作系统命令注入漏洞

Chaos Mesh is an open source cloud-native engineering platform from Chaos Mesh Open Source. Chaos Mesh suffers from an OS command injection vulnerability that stems from the killProcesses mutation being susceptible to an os command injection attack that could lead to remote code execution...

chaos-mesh 操作系统命令注入漏洞

chaos-mesh is an open source engineering platform from Chaos Mesh. Chaos-mesh suffers from an OS command injection vulnerability that stems from the cleanTcs mutation being susceptible to an OS command injection attack that could lead to remote code execution...

PT-2025-37473

Name of the Vulnerable Software and Affected Versions Chaos Mesh versions prior to 2.7.3 Description The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster. This server provides an API that allows attackers to kill...

Chaos Mesh 访问控制错误漏洞

Chaos Mesh is an open source cloud-native engineering platform from Chaos Mesh Open Source. Chaos Mesh suffers from an Access Control Error vulnerability that stems from an unauthenticated GraphQL debugging server being exposed to the entire Kubernetes cluster, potentially resulting in a...

Chaos Mesh 操作系统命令注入漏洞

Chaos Mesh is an open source cloud-native engineering platform from Chaos Mesh Open Source. Chaos Mesh suffers from an OS command injection vulnerability that stems from the presence of OS command injection in cleanIptables, which could lead to remote code execution...

CVE-2025-57086

Tenda W30E V16.01.0.19 5037 was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

Linux Distros Unpatched Vulnerability : CVE-2021-46225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow in the GmfOpenMesh function of libMeshb v7.61 allows attackers to cause a Denial of Service DoS via a crafted MESH file. CVE-2021-46225 Note...

CVE-2025-57086

Tenda W30E V16.01.0.19 5037 was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

Tenda W30E 安全漏洞

Tenda W30E is an enterprise-grade wireless router from Tenda Technology designed for SOHO, small and micro businesses and small stores. The Tenda W30E suffers from a buffer overflow vulnerability that originates from the failure of the String parameter in the formDeleteMeshNode function to...

PT-2025-36907

Name of the Vulnerable Software and Affected Versions: Tenda W30E version V16.01.0.19 Description: The Tenda W30E router contains a stack overflow in the formDeleteMeshNode function due to a vulnerability in the String parameter. This issue allows attackers to cause a Denial of Service DoS via a...