3119 matches found
The vulnerability of the eventHistTriggerParse() function in the kernel/trace/traceEventsHist.c module, which supports Linux operating system kernel tracing, allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the eventHistTriggerParse function in the kernel/trace/traceEventsHist.c module, which supports kernel tracing in Linux operating systems, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...
CVE-2025-15381
A flaw was found in mlflow/mlflow. When the basic-auth application is enabled, tracing and assessment endpoints lack proper permission validation. This allows any authenticated user, even those without specific permissions on an experiment, to read sensitive trace information and create...
BIT-NATS-2026-33249 NATS: Message tracing can be redirected to arbitrary subject
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject,...
openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20416-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20416-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues. The following security issues were fixed: - CVE-2025-39753:...
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Contro...
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in the tracing and assessment endpoints. An attacker can access sensitive trace metadata and create unauthorized assessments by authenticating with any user...
MLFlow allows Tracing + Assessments Access
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...
GHSA-G6PG-52VF-843H MLFlow allows Tracing + Assessments Access
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...
CVE-2025-15381
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...
CVE-2025-15381 Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...
CVE-2025-15381
Affected software: mlflow/mlflow (deployments using mlflow server --app-name=basic-auth). Vulnerability: When the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators, allowing any authenticated user (including those with NO_PERMISSIONS on the exp...
CVE-2025-15381 Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...
CVE-2026-33728 dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access ...
PT-2026-28274
Name of the Vulnerable Software and Affected Versions mlflow/mlflow affected versions not specified Description When the basic-auth application is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, even those with NO PERMISSIO...
The vulnerability of the rb_reset_cpu() function in the kernel/trace/ring_buffer.c module, which supports Linux kernel tracing, allows an attacker to access protected information or cause a service failure.
The vulnerability of the rbresetcpu function in the kernel/trace/ringbuffer.c module, which supports Linux kernel tracing, is related to an infinite loop. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...
The vulnerability of the __doTraceBtrfs__inode() function in the include/trace/events/btrfs.h module of the Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the doTraceBtrfs inode function in the include/trace/events/btrfs.h module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
GO-2026-4826 NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server...
EUVD-2026-16505
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution...
