CVE-2025-59390

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...

The vulnerability of the software platform’s JSON file processing mechanism, based on Git, allows a violator to trigger a service failure. This vulnerability enables a violator to cause a service failure.

The vulnerability of the software platform’s JSON file processing mechanism, based on Git, for collaborative code development in GitLab CE/EE, is related to unlimited resource distribution. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially craft...

The vulnerability of the web interface of the NeMo Agent ToolKit, a tool for creating, profiling, and optimizing AI agents, allows a perpetrator to gain unauthorized access to protected information or cause service failures.

The vulnerability of the web interface of the NeMo Agent ToolKit, a tool for creating, profiling, and optimizing AI agents, is related to the manipulation of requests on the server side. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or...

GHSA-W88F-4875-99C8 Apache Druid’s Kerberos authenticator uses a weak fallback secret

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...

Apache Druid’s Kerberos authenticator uses a weak fallback secret

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...

CVE-2025-59390

Apache Druid (versions through 34.0.0 ) is vulnerable to a Weak Authentication flaw in its Kerberos authenticator. When the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set, the system uses a weak fallback secret generated by ThreadLocalRandom, which is ...

CVE-2025-59390 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator...

PT-2025-48133

Name of the Vulnerable Software and Affected Versions Apache Druid versions prior to 35.0.0 Description The Apache Druid Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. The secret is generated...

The vulnerability of the authentication component of the software protection system for vGate R2 platforms allows a intruder to trigger a service failure.

The vulnerability of the authentication component of the vGate R2 virtualization platform’s security system is related to an excessive number of inefficient data accesses on the server side. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability in the `drivers/media/platform/qcom/iris/iris_core.c` module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/media/platform/qcom/iris/iriscore.c module of the Linux operating system is related to improper resource management. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerabilities of the dqput() and dquot_init() functions in the Linux operating system’s kernel allow a hacker to cause a service failure.

The vulnerabilities of the dqput and dquotinit functions in the Linux operating system are related to resource management errors. Exploiting these vulnerabilities can allow an attacker to cause service failures...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libssh (UTSA-2025-990958)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990958 advisory. A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekeyfromfile function. This flaw can be triggered i...

The vulnerability in the XMLToolMessage class of the langroid Python framework for application development allows a attacker to trigger a service failure or disclose protected information.

The vulnerability of the XMLToolMessage class in the langroid application development framework is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to cause service failures or expose sensitive information...

The vulnerability of the `update_qos_request()` function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the updateqosrequest function in the Linux operating system is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Qwik framework for creating high-performance web applications, related to a exception handling error that allows a hacker to cause a service failure.

The vulnerability of the Qwik framework for creating high-performance web applications is related to an exception handling error. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the Equal() function in the crypto-x509 component of the Go programming language allows a perpetrator to trigger a service failure.

The vulnerability of the Equal function in the crypto-x509 component of the Go programming language is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

The vulnerability of the `net/http` component in the Go programming language, which allows a hacker to trigger a service failure

The vulnerability of the net/http component in the Go programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2025-52754

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to DSA Distributed Switch Architecture and Microchip network devices. Specifically, the ksz irq free function may be called on an uninitialized...

The vulnerability of the GraphQL API interface of the software platform based on git for collaborative code development on GitLab allows a hacker to trigger a service failure.

The vulnerability of the GraphQL API interface of a software platform based on Git for collaborative code development on GitLab is related to unlimited resource distribution. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

The vulnerability of the FFmpeg multimedia library, related to the use of the NULL pointer pointer, allows a hacker to trigger a service failure.

The vulnerability of the FFmpeg multimedia library is related to the dereferencing of the NUL pointer. Exploiting this vulnerability can allow a remote attacker to cause a service failure...