41857 matches found
EUVD-2026-94623
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...
CVE-2026-76271 Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...
CVE-2026-76271
The Discover Splunk Observability Cloud app for Splunk Enterprise is vulnerable to a Denial of Service (DoS) condition in versions below 10.4.3 , 10.2.7 , and 10.0.10 (note: 9.4.x is not affected). A low-privileged user without "admin" or "power" roles can exploit the issue by submitting input to...
CVE-2026-76267 Log Injection through the REST API in Splunk App for Splunk O11y Cloud
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...
CVE-2026-76267
In Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 , a log injection vulnerability exists within the Splunk App for Splunk O11y Cloud . An attacker with the read_o11y_content capability can inject forged entries into the application log via the REST API . This occurs because the ap...
Cross-site Scripting (XSS)
Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...
Arbitrary File Upload
Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...
CVE-2026-59358
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-59358 CVE-2026-59358 Class: Privilege leftover Reach: Remote Cloud Foundry UAA v79.6.0 - VMware by Broadcom / Cloud Foundry Foundation I am @abraxasnull. Loopback lab. The client is...
Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak System
Summary Multiple vulnerabilities affect IBM Cloud Pak System. These vulnerabilties have been addressed with IBM Cloud Pak System 2.3.5.1. Vulnerability Details CVEID:CVE-2025-15467 DESCRIPTION: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD...
spring-cloud-gateway-cve-2022-22947-report
spring-cloud-gateway-cve-2022-22947-report Technical report about CVE-2022-22947 in Spring Cloud Gateway and its exploitation through exposed Actuator endpoints...
EUVD-2026-94003
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...
Backstage: Improper input validation in cloud storage URL readers
Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...
EUVD-2026-94015
Backstage: Improper input validation in cloud storage URL readers...
GHSA-7649-WM97-W3J3 Backstage: Improper input validation in cloud storage URL readers
Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...
ROOT-APP-MAVEN-AIKIDO-2026-48519 AIKIDO-2026-48519 in org.springframework.cloud:spring-cloud-commons - Patched by Root
Root has patched AIKIDO-2026-48519 in the org.springframework.cloud:spring-cloud-commons package for Root:Maven. Multiple fixed versions available...
GHSA-5CWM-P7PJ-GQP2 vulnerabilities
Vulnerabilities for packages: nrdot-collector, google-cloud-otel-ops-collector...
CVE-2026-86597 vulnerabilities
Vulnerabilities for packages: nrdot-collector, google-cloud-otel-ops-collector...
GHSA-QQJ6-54Q6-CXV6 vulnerabilities
Vulnerabilities for packages: nrdot-collector, google-cloud-otel-ops-collector...
