244 matches found
Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...
GHSA-R56G-Q4P6-M3P6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...
CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...
CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...
CVE-2026-73247
Kestra prior to 2.0.0 has a SSRF-like issue in HttpFunction.java: the user-controlled http() URI is passed to URI.create() and used by the server-side HTTP client without restricting private, loopback, or link-local destinations. This allows an unauthenticated attacker to import and execute a flo...
CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...
org.http4k:http4k-aws (2.10.0), org.http4k:http4k-client-apache (2.10.0) +4 more potentially affected by unknown CVE via org.http4k:http4k-core (2.10.0)
org.http4k:http4k-core MAVEN version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.10.0 - org.http4k:http4k-client-apache 2.10.0 - org.http4k:http4k-contract 2.10.0 -...
org.http4k:http4k-aws (3.13.2), org.http4k:http4k-contract (3.13.2) +4 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.13.2)
org.http4k:http4k-core MAVEN version 3.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.13.2 - org.http4k:http4k-contract 3.13.2 - org.http4k:http4k-template-dust 3.13.2 -...
org.http4k:http4k-aws (2.10.0), org.http4k:http4k-client-apache (2.10.0) +4 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (2.10.0)
org.http4k:http4k-core MAVEN version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.10.0 - org.http4k:http4k-client-apache 2.10.0 - org.http4k:http4k-contract 2.10.0 -...
CVE-2025-69969
A lack of authentication and authorization mechanisms in the Bluetooth Low Energy BLE communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is...
CVE-2025-69969
A lack of authentication and authorization mechanisms in the Bluetooth Low Energy BLE communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is...
CVE-2025-69969
A lack of authentication and authorization mechanisms in the Bluetooth Low Energy BLE communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is...
CVE-2025-69969: Missing Encryption of Sensitive Data
A lack of authentication and authorization mechanisms in the Bluetooth Low Energy BLE communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is...
SRK Powertech Pebble Prism Ultra security vulnerabilities
The SRK Powertech Pebble Prism Ultra is a Bluetooth-enabled smartwatch produced by the Indian company SRK Powertech. Version 2.9.2 of the SRK Powertech Pebble Prism Ultra contains a security vulnerability. This vulnerability stems from the lack of authentication and authorization mechanisms in th...
PT-2026-22940
Name of the Vulnerable Software and Affected Versions SRK Powertech Pvt Ltd Pebble Prism Ultra version 2.9.2 Description A lack of authentication and authorization mechanisms in the Bluetooth Low Energy BLE communication protocol allows attackers to reverse engineer the protocol and execute...
EUVD-2025-208281
A lack of authentication and authorization mechanisms in the Bluetooth Low Energy BLE communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is...
CVE-2025-69969
A lack of authentication and authorization mechanisms in the Bluetooth Low Energy BLE communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is...
BIT-PEBBLE-2024-3250
It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2,...
TencentOS Server 4: radare2 (TSSA-2024:1041)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1041 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...