GHSA-69CC-CV78-QC8G vulnerabilities

Vulnerabilities for packages: ontop, thingsboard, kayenta-fips, ontop-fips, kayenta, nacos-docker, nacos, camunda, camunda-zeebe...

ai.telosforge:kimaira-starter-agentic (>=1.2.4 <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4 <=1.2.6) +504 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (>=0.13.0 <=1.0.0-RC3)

io.modelcontextprotocol.sdk:mcp-core MAVEN version =0.13.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.0.1, =0.1.0, =0.3.0, =2.0.0-beta.7, =1.1.0.0, =1.1.0.0, =2.0.0-M1.1 and more Source cves: CVE-2026-35568 Source advisory: OSV:GHSA-8JXR-PR72-R468...

CVE-2026-24734 vulnerabilities

Vulnerabilities for packages: ontop, kayenta-fips, ontop-fips, kayenta, nacos-docker, nacos...

GHSA-MGP5-RV84-W37Q vulnerabilities

Vulnerabilities for packages: ontop, kayenta-fips, ontop-fips, kayenta, nacos-docker, nacos...

cc.chensoul.nacos:nacos-distribution (=2.5.2), com.buession.security:buession-security-spring (>=3.0.0 <=3.0.1) +521 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (>=5.8.0 <=5.8.16)

org.springframework.security:spring-security-web MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.12.0, =5.12.0, =1.48.0, =1.48.0, =1.48.0, =2.4.0, =2.4.0, =2.4.0, =4.5.0, =4.5.0, =4.5.1 and more Source cves: CVE-2026-22732 Source advisory: OSV:GHSA-MF92-479X-3373...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: thingsboard, localstack, ontop-fips, kayenta, management-api-for-apache-cassandra-5.0, zookeeper-fips, cassandra-fips, knative-kafka-broker, dependency-track, knative-kafka-broker-fips, apache-nifi-registry, management-api-for-apache-cassandra-4.1, ontop,...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: thingsboard, localstack, ontop-fips, kayenta, management-api-for-apache-cassandra-5.0, zookeeper-fips, cassandra-fips, knative-kafka-broker, dependency-track, knative-kafka-broker-fips, apache-nifi-registry, management-api-for-apache-cassandra-4.1, ontop,...

EUVD-2021-1841

Malware in sbrugna...

EUVD-2022-6208

Malicious code in bioql PyPI...

EUVD-2022-1307

Malicious code in bioql PyPI...

EUVD-2023-2356

Malicious code in bioql PyPI...

CVE-2021-29442

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly...

CVE-2021-29441

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication -Dnacos.core.auth.enabled=true Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor...

CVE-2020-19676

Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in...

cc.chensoul.nacos:nacos-distribution (=2.5.2), cn.sparrowmini:sparrow-org-service (=0.0.1) +618 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=5.8.0 <=5.8.16)

org.springframework.security:spring-security-crypto MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5Chttp...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0-20260516144515 <=1.0.0.ee-20260528111216), cc.zzzyu.nacos:default-auth-plugin (=3.1.1) +140 more potentially affected by CVE-2024-38829 via org.springframework.ldap:spring-ldap-core (>=3.0.0 <=3.2.7)

org.springframework.ldap:spring-ldap-core MAVEN version =3.0.0, =1.0.0-20260516144515, =0.0.11, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.11.5 and more Source cves: CVE-2024-38829 Source advisory: OSV:GHSA-MQVR-2RP8-J7H4...

Exploit for Missing Authentication for Critical Function in Alibaba Nacos

Introduction The Nacos Derby command execution vulnerability...

cc.chensoul.nacos:core-test (=2.5.2), cc.chensoul.nacos:nacos-address (=2.5.2) +381 more potentially affected by CVE-2024-46983 via com.alipay.sofa:hessian (>=3.3.0 <=3.5.4)

com.alipay.sofa:hessian MAVEN version =3.3.0, =3.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.alipay.sofa:hessian and may be impacted: - cc.chensoul.nacos:core-test =2.5.2 - cc.chensoul.nacos:nacos-address =2.5.2 - cc.chensoul.nacos:nacos-cm...

VulnCheck KEV: CVE-2021-29441

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication -Dnacos.core.auth.enabled=true Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor...

VulnCheck KEV: CVE-2021-29442

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly...