85 matches found
CVE-2026-48050
Arc (an open SQL-native time-series database for telemetry) versions prior to 26.06.1 expose Go's net/http/pprof debug endpoints at /debug/pprof/* without authentication. The root cause is that /debug/pprof is added to PublicPrefixes in cmd/arc/main.go, causing the auth middleware to short-circui...
PT-2026-79499
Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description The cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope of inbound messages. The MsgReplicateSync payload is accepted without...
PT-2026-79498
Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description Arc Enterprise's Raft FSM Finite State Machine in the applyRegisterFile function accepts attacker-chosen file paths in manifest-registration proposals without validating them against the...
CVE-2026-62353
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user...
CVE-2026-62353
TDengine before version 3.4.1.14 contains an out-of-bounds read in the SQL lexer (parTokenizer.c tGetToken) where a trailing backslash in a string literal can cause the parser to read beyond the null terminator, potentially crashing the server and leaking adjacent memory. The issue requires an au...
CVE-2026-62351
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg read STransCompMsg.contLen when pHead-comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causi...
EUVD-2026-44770
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg read STransCompMsg.contLen when pHead-comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causi...
PT-2026-60266
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side...
PT-2026-60265
TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString checks space for only one byte before processing SQL string escape sequences %, , or x, allowing a one-byte out-of-bounds write to the sta...
[SECURITY] Fedora 43 Update: prometheus-3.13.1-1.fc43
The Prometheus monitoring system and time series database...
[SECURITY] Fedora 44 Update: prometheus-3.13.1-1.fc44
The Prometheus monitoring system and time series database...
[SECURITY] Fedora 44 Update: prometheus-3.13.0-1.fc44
The Prometheus monitoring system and time series database...
[SECURITY] Fedora 43 Update: prometheus-3.13.0-1.fc43
The Prometheus monitoring system and time series database...
[SECURITY] Fedora 44 Update: prometheus-3.12.0-1.fc44
The Prometheus monitoring system and time series database...
[SECURITY] Fedora 43 Update: prometheus-3.12.0-1.fc43
The Prometheus monitoring system and time series database...
PT-2026-48533
Name of the Vulnerable Software and Affected Versions TDengine versions 3.4.0.0 through 3.4.1.5 Description An unauthenticated remote attacker can cause the taosd server process to crash by sending a single crafted RPC Remote Procedure Call packet. This action does not require any credentials or ...
CVE-2026-42087
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database TSDB component of COSMOS. The tsdblookup function in the...
CVE-2026-42087
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database TSDB component of COSMOS. The tsdblookup function in the...
PYSEC-2026-2244
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database TSDB component of COSMOS. The tsdblookup function in the...
CVE-2026-42087 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database TSDB component of COSMOS. The tsdblookup function in the...