CVE-2026-56121_exploit

CVE-2026-56121 — Feast Registry Unauthenticated RCE dill.loads Unauthenticated remote code execution in the Feast feature store's registry gRPC server. The ApplyFeatureView RPC rebuilds an OnDemandFeatureView from the request proto. Doing so base64-decodes spec.userdefinedfunction.body and passes...

EUVD-2026-105987

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-grpc-server. Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. While the vulnerability is...

CVE-2026-101579

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-grpc-server. Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. While the vulnerability is...

CVE-2026-101579

The helidon-grpc-server component within the Helidon product of Oracle Fusion Middleware is affected by a vulnerability in versions 3.0.0-3.2.21 . An unauthenticated attacker with network access via HTTP/2 can easily exploit this issue to compromise the system. Successful exploitation may lead to...

CVE-2026-102477

A flaw was found in Eclipse Vert.x vertx-grpc-server. The server's configured maximum message size limit is enforced only on the received compressed data rather than on the uncompressed payload. A remote attacker can exploit this flaw by sending a specially crafted compressed message, causing...

PT-2026-119259

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-grpc-server. Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. While the vulnerability is...

Oracle Helidon security vulnerabilities

Oracle Helidon versions 3.0.0 to 3.2.21 have security vulnerabilities. These vulnerabilities stem from issues with the helidon-grpc-server component. Unauthorized attackers may gain access through HTTP/2 networks, allowing them to perform unauthorized updates, insert or delete certain accessible...

io.mishmash.opentelemetry:collector-embedded (1.2.1), io.mishmash.opentelemetry:persistence-protobuf (1.2.1) +33 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=5.1.2, <=5.1.9)

io.vertx:vertx-grpc-server MAVEN version =5.1.2, =1.0.6, =5.1.2-mmio.1.0, =4.0.0.beta2, =0.1.0, =0.1.0, =0.2.0 - io.quarkus:quarkus-grpc 4.0.0.beta1 - io.quarkus:quarkus-grpc-common 4.0.0.beta1 and more Source cves: CVE-2026-102477 Source advisory: MEND:CVE-2026-102477...

ai.agentican:agentican-quarkus-otel (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-otel-store-jpa (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +653 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.34)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.4, =0.3.0, =0.3.0, =0.0.22, =0.0.2, =0.0.18 and more Source cves: CVE-2026-102477 Source advisory: MEND:CVE-2026-102477...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the gzip-decoding path in GrpcReadStreamBase used by GrpcServerRequestImpl. An attacker can send a small gzip-compressed gRPC request that expands beyond the configured...

CLEANSTART-2026-AW40978 frontend gRPC server's streaming interceptor chain did not include the authorization interceptor

Security vulnerability affects the temporal-server-fips package. The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor...

PT-2026-122693

Security vulnerability affects the temporal-server-fips package. The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor...

CVE-2026-100394

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and...

CVE-2026-100394 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and...

CVE-2026-100394: Concurrent Execution using Shared Resource with Improper Synchronization

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and...

CVE-2026-63688

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-63688

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-63688

Dell Container Storage Modules (CSM) versions prior to v1.18.0 are vulnerable to a Missing Authentication for Critical Function flaw in the csm-authorization-storage gRPC server . An unauthenticated remote attacker can exploit this to gain unauthorized access to storage backend administrator cred...

CVE-2026-63688

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-63688: Missing Authentication for Critical Function

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...