43 matches found
EUVD-2026-108343
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting require...
CVE-2026-112330
The Motor.NET library (versions before 0.19.0 ) is vulnerable to a Denial of Service (DoS) attack via RabbitMQ when processing messages with crafted CloudEvents headers . A remote attacker capable of publishing to a consumed queue can provide an invalid cloudEvents:motorversion, a single double-q...
CVE-2026-112330 Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single...
EUVD-2026-108342
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single...
CVE-2026-111999
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...
CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...
EUVD-2026-103452
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...
CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...
CVE-2026-111999
Versions 0.8.0 through 0.9.0 of Vanus are affected by a missing authentication vulnerability in the gateway CloudEvents HTTP receiver . This flaw allows unauthenticated remote attackers to bypass token authentication and authPublish checks by sending forged CloudEvents to the /namespaces/{ns}/eve...
CVE-2026-71576
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...
CVE-2026-71576
CVE-2026-71576 affects multicluster-global-hub: the manager component improperly validates the source identity of CloudEvents on Kafka status topics. A remote attacker who compromises a managed hub and obtains its Kafka client certificate can manipulate the self-asserted source identity, enabling...
CVE-2026-71576 Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...
CVE-2026-71576
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...
CVE-2026-71576: Insufficient Verification of Data Authenticity
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...
PT-2026-69872
Name of the Vulnerable Software and Affected Versions multicluster-global-hub affected versions not specified Description The manager component fails to properly validate the source identity of incoming CloudEvents on Kafka status topics. A remote attacker who has compromised a managed hub and...
com.slack.api:bolt-http4k (1.22.1), org.http4k:http4k-aws (4.25.14.0) +64 more potentially affected by unknown CVE via org.http4k:http4k-core (4.25.14.0)
org.http4k:http4k-core MAVEN version 4.25.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - com.slack.api:bolt-http4k 1.22.1 - org.http4k:http4k-aws 4.25.14.0 - org.http4k:http4k-client-apache 4.25.14.0 ...
EUVD-2025-4494
Malicious code in bioql PyPI...
EUVD-2024-0835
Malicious code in bioql PyPI...
CVE-2024-55156
An XML External Entity XXE vulnerability in the deserializeArgs method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message...
CVE-2024-55156
An XML External Entity XXE vulnerability in the deserializeArgs method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message...