key-transparency-auditor

key-transparency-auditor A reference implementation of a third-party auditor for Signal's key transparency service, based on the key transparency specification. Overview This service is written in Java using the Micronaut framework. To build and unit test, run ./mvnw clean test in the root...

Oracle Database Server (October 2026 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the RDBMS OpenSSL component of Oracle Database Server. Supported versions that are affected are 19.3-19.32 and...

com.flipkart.krystal:vajram-sql-vertx (>=11.0.0, <=11.0.1), com.flipkart.krystal:vajram-sql-vertx-codegen (>=11.0.0, <=11.0.1) +20 more potentially affected by CVE-2026-103224 via io.vertx:vertx-mysql-client (>=5.1.0, <=5.1.9)

io.vertx:vertx-mysql-client MAVEN version =5.1.0, =11.0.0, =11.0.0, =1.11.0, =1.11.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =4.5.3, =7.1.0, =7.1.3 and more Source cves: CVE-2026-103224 Source advisory: MEND:CVE-2026-103224...

com.flipkart.krystal:vajram-sql-vertx (>=11.0.0, <=11.0.1), com.flipkart.krystal:vajram-sql-vertx-codegen (>=11.0.0, <=11.0.1) +20 more potentially affected by CVE-2026-102466 via io.vertx:vertx-mysql-client (>=5.1.0, <=5.1.9)

io.vertx:vertx-mysql-client MAVEN version =5.1.0, =11.0.0, =11.0.0, =1.11.0, =1.11.0, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =4.5.3, =7.1.0, =7.1.3 and more Source cves: CVE-2026-102466 Source advisory: MEND:CVE-2026-102466...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

key-transparency-auditor v20260818.0.0

key-transparency-auditor A reference implementation of a third-party auditor for Signal's key transparency service, based on the key transparency specification. Overview This service is written in Java using the Micronaut framework. To build and unit test, run root@kitploit: ./mvnw clean test in...

CVE-2026-73245

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245

Kestra, an open-source event-driven orchestration platform, prior to 2.0.0-rc6 exposed Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env to disclose resolved configuration and POST /loggers/{...

CVE-2026-73245 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245: Missing Authentication for Critical Function

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

PT-2026-70935

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 2.0.0-rc6 Description Kestra serves Micronaut management endpoints on port 8081 without authentication, bypassing the Basic Auth protection applied to the /api/v1/ endpoints on port 8080. This allows unauthenticated...

Insufficiently Protected Credentials

Overview io.micronaut:micronaut-http-client is a modern, JVM-based, full stack microservices framework designed for building modular, easily testable microservice applications. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the DefaultHttpClient proces...

com.c0x12c:module-ai-image (>=0.12.0, <=0.17.0), com.c0x12c:module-ai-module-impl (>=0.5.0, <=0.17.0) +293 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client-core (>=4.0.0-m1, <=4.10.23)

io.micronaut:micronaut-http-client-core MAVEN version =4.0.0-m1, =0.12.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.10.0, =0.8.0, =0.5.0, =0.2.15, =0.0.12, =0.0.14 - com.jongsoft.finance:bpmn-process 3.2.0 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-IOMICRONAUT-17912689...

com.c0x12c:module-ai-image (>=0.12.0, <=0.17.0), com.c0x12c:module-ai-module-impl (>=0.5.0, <=0.17.0) +275 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=4.0.0-m1, <=4.10.23)

io.micronaut:micronaut-http-client MAVEN version =4.0.0-m1, =0.12.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.10.0, =0.8.0, =0.0.12, =0.0.14 - com.jongsoft.finance:bpmn-process 3.2.0 - com.jongsoft.finance:core 3.2.0 - com.jongsoft.finance:domain 3.2.0 - com.jongsoft.finance:fintrack-ap...

GHSA-Q6GH-6V2R-HJV3 Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers

Impact DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL. Additionally, no maximum redirect count exists, enabling infinite loop DoS. Affected:...