EUVD-2026-63477

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63042

Apache InLong (versions 2.0.0 through before 2.4.0) contains a missing authorization flaw on its DataNode management endpoints. Any user who can authenticate to the manager can create, modify, and delete Data Node definitions , leading to high impact on integrity and availability (CVSS 8.1, HIGH)...

CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-63037

CVE-2026-63037 is an unauthenticated SQL injection in Apache InLong (versions 2.0.0 through before 2.4.0 ), targeting the ORDER BY clause of the Manager OpenAPI audit alert rule list endpoint against the backend database. The flaw requires no authentication (CVSS 3.1: 9.8 CRITICAL , vector AV:N/A...

EUVD-2026-63398

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.5.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn b...

Azure Data Manager for Energy Remote Code Execution Vulnerability

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

IDS Deployment & Packet Analysis Network intrusion detectio...

Johnson Controls Simplex Incident Manager

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials passwords and authentication tokens from system memory, potentially leading to unauthorized access to the application and connected systems. 2. RECOMMENDED...

GO-2026-6107 vulnerabilities

Vulnerabilities for packages: kube-conformance, multicluster-controlplane-fips, kyverno, cert-manager, multicluster-controlplane, reports-server, hubble, cilium, milvus, cilium-cli, dapr, kots, minio, rancher-support-bundle-kit, commercial-grafana, kubernetes, external-dns, loki, kine...

GO-2026-6107 vulnerabilities

Vulnerabilities for packages: external-dns, kine, kots, cilium-cli, loki, minio, kyverno, cilium, hubble, cert-manager, kubernetes, dapr...

GHSA-6VCH-Q96H-7GC3 vulnerabilities

Vulnerabilities for packages: external-dns, kine, kots, cilium-cli, loki, minio, kyverno, cilium, hubble, cert-manager, kubernetes, dapr...

CVE-2026-73500 vulnerabilities

Vulnerabilities for packages: external-dns, kine, kots, cilium-cli, loki, minio, kyverno, cilium, hubble, cert-manager, kubernetes, dapr...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, tekton-pipelines, tkn, cluster-api-gcp-controller, spicedb, kyverno-notation-aws, spqr, tetragon, cluster-api-aws-controller, kubescape, apisix-ingress-controller, grafana, cilium, flux-notification-controller, emissary, kuma, tekton-chains...

CVE-2026-73500 affecting package cert-manager for versions less than 1.12.15-12

CVE-2026-73500 affecting package cert-manager for versions less than 1.12.15-12. A patched version of the package is available...

EUVD-2026-62948

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's tokenserial parameter is not masked...

EUVD-2026-62918

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

EUVD-2026-62900

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the editmanagerxml capability could write a malicious Splunk Web Manager Extensible Markup Language XML configuration. When the same user opens the affected Splunk Web Manag...

EUVD-2026-63122

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect syste...

EUVD-2026-63121

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect syst...