5287 matches found
CVE-2026-82428
The Apache Storm Client is vulnerable to cross-tenant dependency jar substitution due to predictable blob keys. When using the storm jar --artifacts feature, dependency artifacts are stored under keys derived solely from Maven coordinates (e.g., dep---.jar). Because these keys are predictable and...
CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
EUVD-2026-77529
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
EUVD-2026-77516
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
CVE-2026-82437 Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
CVE-2026-82437
The Apache Storm Logviewer suffers from a flaw where log access controls are not enforced for daemon logs. Specifically, the system incorrectly discards authorizer results when a "this is a daemon log" flag is set, and certain endpoints reach handlers without consulting an authorizer. This allows...
CVE-2026-82437 Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...
CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...
CVE-2026-82441
Apache Storm Nimbus is vulnerable to cross-tenant blob deletion and a cluster denial of service due to improper validation of dependency_jars and dependency_artifacts keys in submitted topologies. Because Nimbus performs no validation on the submission path, a malicious submitter can list keys be...
CVE-2026-90936
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...
CVE-2025-68624
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...
CVE-2026-82028: Improper Neutralization of Special Elements used in an SQL Command
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...
PT-2026-91443
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...
PT-2026-91226
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
CVE-2026-82428: Improper Limitation of a Pathname to a Restricted Directory
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
EUVD-2025-210903
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...
CVE-2025-68624
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...
CVE-2025-68624
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...
CVE-2025-68624
N-able Mail Assure (formerly SolarWinds MSP Mail Assure), a cloud-based multi-tenant SMTP relay, contains a design-level authorization flaw (CWE-290) where an authenticated SMTP user can send outbound mail using MAIL FROM addresses of other tenants . After valid SMTP AUTH, the server accepts arbi...