SUSE CVE-2026-41492

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can...

SUSE CVE-2026-55882

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memor...

CVE-2026-28811

Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue...

JLSEC-2026-1068 ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when...

ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed read past the profile boundary. This behavior occurs whe...

EUVD-2026-51178

Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue...

CVE-2026-28811

CVE-2026-28811 affects Apache JSPWiki (up to version 2.12.3). The issue is disclosed as debug/error handling that reveals unnecessary information in responses. A patch is available in JSPWiki 2.12.4 to fix this behavior. Impact details in the provided sources are limited to information disclosure...

CVE-2026-28811 Apache JSPWiki: Error Handling - Reveals Error Details

Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

EUVD-2026-51155

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186

The CVE-2026-41186 issue affects Calico components (shared debug server used by kube-controllers and Goldmane). When enabled, the Go pprof debug listener binds to 0.0.0.0 and lacks authentication, allowing any pod with network reachability to access internal memory state via the heap, goroutine s...

CVE-2026-47873 Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier...

CVE-2026-47873

The Boots Dashboard Docker integration in Spring Tools exposes container control ports on all host interfaces (0.0.0.0) instead of restricting to loopback, affecting Spring Tools for Eclipse (version 5.2.0 and earlier). The CVE-2026-47873 entry indicates a high-severity issue with CVSS 3.1: AV Ad...

PT-2026-66615

Name of the Vulnerable Software and Affected Versions RCU II+ affected versions not specified Multiload II+ affected versions not specified Description An unauthenticated service exposes a debug interface that grants full root-level access to the embedded system. This issue is caused by a...

PT-2026-66512

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description Debug messages reveal unnecessary information, which could potentially expose sensitive system details. Recommendations Upgrade to version 2.12.4...

CVE-2026-59947

A flaw was found in Composer, a dependency manager for the PHP language. When Composer is executed with the -vvv debug verbosity option, it can inadvertently expose sensitive credentials, such as a GitHub Personal Access Token, by printing them in the debug output. This occurs because certain...

CVE-2026-64316

A flaw was found in the Linux kernel's crypto: caam module. This vulnerability allows for information disclosure where sensitive cryptographic key material could be leaked at runtime. This occurs when the CONFIGDYNAMICDEBUG option is enabled, due to improper guarding of key dumps in the setkey an...

CVE-2026-64352

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When certain security modules interact with network routing tables, it can trigger diagnostic warnings. This issue primarily affects debug kernels by generating console messages and does not lead to direct security...