CVE-2026-74652

A use-after-free vulnerability in the Linux kernel's amba-pl011 serial driver affects the RS485 trigger high-resolution timers (hrtimers). These timers are embedded in the devm-managed port and can fire after the port is freed, because the IRQ handler may arm a timer before the timers are cancele...

EUVD-2026-63619

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

CVE-2026-65770

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

CVE-2026-65770

Azure Managed Instance for Apache Cassandra is affected by an argument injection vulnerability (improper neutralization of argument delimiters in a command) that allows an unauthorized attacker to execute code over a network without any privileges or user interaction. The CVSS 3.1 score is 10.0 (...

CVE-2026-65770 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

...

CVE-2026-65770 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

...

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

PacketFence Cloud: Enterprise Network Access Control, Now a Managed Service

...

PT-2026-79199

Name of the Vulnerable Software and Affected Versions Azure Managed Instance for Apache Cassandra affected versions not specified Description Improper neutralization of argument delimiters in a command, known as argument injection, allows an unauthorized attacker to execute code over a network...

CVE-2026-65770: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

CVE-2026-66794

A critical (CVSS 9.3) unauthenticated SSRF vulnerability exists in the cluster-proxy-addon component of Multicluster Engine for Kubernetes . An attacker with network access to the user-facing route can bypass authentication and authorization by manipulating URL path segments, proxying requests to...

CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

PT-2026-79947

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

CVE-2026-76827: Protection Mechanism Failure

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

CVE-2026-61003

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware component: MFT Runtime Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise...

EUVD-2026-61302

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware component: MFT Runtime Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise...

CVE-2026-75924

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...

CVE-2026-75924 Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...

CVE-2026-75924 Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...