Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via ProcedureDescription.computeReturnTypeAsJavaClass in src/main/java/com/rabbitmq/tools/jsonrpc/ProcedureDescription.java. An attacker can trigger loadin...

CVE-2026-70415

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service...

CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

CVE-2026-70415

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service...

EUVD-2026-61058

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution and Denial of service...

CVE-2026-70415

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service...

GO-2026-6114 Watch API authorization bypass in go.etcd.io/etcd/server/v3

In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey. The Watch RPC handler normalized open-ended range ends prior to authorization...

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forNamejavaReturnType with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist. Vulnerable code ProcedureDescription.java:101-127: When a JsonRpcClient connects, it calls...

GHSA-6G32-PXV4-2WFJ RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forNamejavaReturnType with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist. Vulnerable code ProcedureDescription.java:101-127: When a JsonRpcClient connects, it calls...

CVE-2026-63337 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

CVE-2026-63337

The RabbitMQ Java client (pre-5.33.0) passes an untrusted javaReturnType from system.describe through Class.forName with initialization enabled, allowing an attacker controlling broker responses to trigger arbitrary class static initializers in the victim JVM, affecting confidentiality, integrity...

EUVD-2026-61043

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

PT-2026-77211

Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.33.0 Description The RabbitMQ Java client library contains an issue where com.rabbitmq.tools.jsonrpc.ProcedureDescription processes a javaReturnType value from an untrusted system.describe...

PT-2026-80360

In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey. The Watch RPC handler normalized open-ended range ends prior to authorization...

CVE-2026-70415: Buffer Copy without Checking Size of Input

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service...

JetBrains Datalore 2026.2.3 Remote Code Execution

JetBrains Datalore On-Premises version 2026.2.3 contains an authorization flaw in publicly shared interactive reports. An unauthenticated remote attacker with access to a public report can have READ permissions incorrectly mapped to EXECUTE permissions, allowing access to computation RPC methods...

CVE-2026-52731: Uncaught Exception

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-rpc/src/methods/types/longpoll.rs, LongPollId::fromstr...

PT-2026-77228

Name of the Vulnerable Software and Affected Versions Dell PowerStore SDNAS affected versions not specified Description An issue exists in the NFS/RPC component where a buffer copy is performed without checking the size of the input. This allows an unauthenticated remote attacker to potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-72465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in...

Malicious code in sui-move-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cceb15de1ddd23a55de69afe59a00c79dcc23f8ce3dfed33592d781bddfbb5a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...