CVE-2019-12475

CVE-2019-12475 XSS almacenado en MicroStrategy Web anterior a 10.4.6 Autor: undefinedmode https://github.com/undefinedmode/CVE-2019-12453 XSS almacenado en la métrica que se activa al abrir el editor de Threshold visual. Reportado al proveedor en 2017 y corregido rápidamente en la versión 10.4.6...

PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

Linux Distros Unpatched Vulnerability : CVE-2026-101333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the...

CVE-2026-101333 Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

CVE-2026-101333

A flaw in the Micrometer user-event metrics listener of Keycloak , an identity and access management solution, allows an unauthenticated attacker to create an unlimited number of metric time series. This occurs when the listener is configured to include the idp tag and an attacker sends requests ...

GitHub Engagement Signals for CVE Prioritization: The GitHub Popularity Metric (GPM)

Whitepaper called GitHub Engagement Signals For CVE Prioritization: The GitHub Popularity Metric GPM...

io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl

A flaw was found in the Linux kernel's accel/ivpu component. This vulnerability, a buffer overflow, occurs when the firmware returns a size larger than the allocated buffer during a metric stream information query. This can lead to an incorrect buffer copy, potentially causing system instability ...

Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service

Summary Multiple vulnerabilities have been addressed in components of VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network...

Security Bulletin: Multiple Vulnerabilities were found in IBM License Metric Tool

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any wsdl:import...

io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid double-rtnllock ELP metric worker The batadvvelpgetthroughput function might be called when the RTNL lock is already held. This could be problematic when the work queue item is cancelled using...

Improper Input Validation

Micrometer is vulnerable to improper input validation. The vulnerability is due to the use of untrusted, non-normalized input for metric names, tag keys, and tag values, which allows an attacker to supply malicious or unexpected metrics data and potentially cause security or operational issues in...

Malicious code in svelte-map-metric (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2880778c6f9a95fb00d5476c859051c8d9645b321b6d84613a3c28fd55ed0bef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14499 Malicious code in svelte-map-metric (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2880778c6f9a95fb00d5476c859051c8d9645b321b6d84613a3c28fd55ed0bef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

BIT-KEYCLOAK-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

CVE-2026-79668

Ech0 versions before 4.7.3 contain an authentication bypass in the PUT /api/echo/like/:id endpoint. The endpoint lacks both identity verification and rate limiting, allowing unauthenticated attackers to repeatedly increment the fav_count field for any known echo identifier. This can arbitrarily i...

CVE-2026-79668 Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

CVE-2026-79668 Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

CVE-2026-79668 Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...