CVE-2026-40173

Dgraph (Open Source GraphQL DB) versions

CVE-2026-40173

Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line...

PT-2026-33176

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.2 Description An unauthenticated credential disclosure exists where the '/debug/pprof/cmdline' endpoint is registered on the default mux and accessible without authentication. This exposes the full process command...

GO-2026-4334 Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet

Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet...

PT-2026-6509

Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet...

CVE-2026-23517

Fleet (open source device management software) has a broken access control vulnerability in debug/pprof endpoints that allows any authenticated user, including the lowest-privilege Observer role, to access internal server diagnostics and trigger CPU-intensive profiling operations. This affects ve...

Fleet has an Access Control vulnerability in debug/pprof endpoints

Summary A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Impact Fleet’s debug/pprof endpoints...

The vulnerability of the SpiceDB database, related to deficiencies in the error reporting mechanism, allows an intruder to gain unauthorized access to protected information.

The vulnerability of the SpiceDB database is related to deficiencies in the mechanism for generating error reports when processing the /debug/pprof/cmdline command with the --grpc-preshared-key parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...