Milvus - Unauthenticated Metrics API Access

Milvus 2.5.27 and 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091. id: CVE-2026-26190 info: name: Milv...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

11in1 CMS 1.2.1 - Local File Inclusion (LFI)

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php. id: CVE-2012-0996 info: name: 11in1 CMS 1.2.1 - Local File Inclusion LFI author: daffainfo...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...

Apache Solr - Host Environment Variables Leak via Metrics API

Exposure of Sensitive Information to an Unauthorized Actor Vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users can specify which environment variables to hide, however, the default list is designed to wor...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, cluster-api-helm-controller, cilium, kube-state-metrics, kubernetes-csi-external-provisioner, kube-metrics-adapter, helm-operator, azure-service-operator, cluster-api-ipam-provider-in-cluster, metrics-server, rancher-system-agent,...

EUVD-2026-63114

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...

CVE-2026-76262

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...

CVE-2026-76262

CVE-2026-76262 affects Splunk Enterprise 10.4 versions below 10.4.2 . The Edge Processor SPL2 Preview sidecar exposes its Prometheus metrics endpoint without authentication, allowing any unauthenticated network client to retrieve runtime and build metadata for the sidecar. The vulnerability is li...

GO-2025-3777 vulnerabilities

Vulnerabilities for packages: prometheus-podman-exporter-fips, prometheus-podman-exporter...

GO-2023-2045 vulnerabilities

Vulnerabilities for packages: metrics-server...

GO-2023-2044 vulnerabilities

Vulnerabilities for packages: metrics-server...

GO-2023-2042 vulnerabilities

Vulnerabilities for packages: metrics-server...

GO-2022-0619 vulnerabilities

Vulnerabilities for packages: kube-state-metrics, kubeflow, kubeflow-fips...

GO-2022-1130 vulnerabilities

Vulnerabilities for packages: prometheus-pushgateway, prometheus-pushgateway-fips, kube-state-metrics...

GO-2023-2041 vulnerabilities

Vulnerabilities for packages: metrics-server, kind, kubeflow-katib...

GO-2023-2043 vulnerabilities

Vulnerabilities for packages: metrics-server, kind, kubeflow-katib...

GO-2024-3205 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, fq...

GO-2026-5208 vulnerabilities

Vulnerabilities for packages: temporal-fips, fq, snyk-cli, kube-metrics-adapter-fips, temporal-ui-server, kube-metrics-adapter, temporal-ui-server-fips, gotenberg, temporal...

GO-2023-1571 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, kubeflow-katib, wireguard-go, grpcurl, gke-gcloud-auth-plugin, dynamic-localpv-provisioner-fips, terraform-provider-sendgrid-fips, dynamic-localpv-provisioner, kube-state-metrics, k3d, go, hey, kubeflow, restic, kubeflow-fips...