CVE-2026-63336 RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-63336

Prior to 5.33.0, the RabbitMQ Java client's useSslProtocol() methods installed a TrustEverythingTrustManager and disabled hostname verification, accepting any certificate. A network attacker could impersonate the broker, read protected AMQP traffic, and modify it. Fixed in 5.33.0, which uses the ...

CVE-2026-69219

The vulnerability is in ValueReader.readBytes in ValueReader.java of the RabbitMQ Java client prior to 5.33.1: it allocates a byte array based on a wire-declared length before verifying available frame data, allowing a malicious AMQP peer to trigger a ~2 GB allocation and OutOfMemoryError during ...

CVE-2026-48798 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...

ANT-2026-REDYDMAE · supabase/supabase · xss

xss medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-REDYDMAE: DOM-based XSS via javascript: scheme in URL hostname check The isVercelUrl helper checks only that ne...

CVE-2026-75854

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75852

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...

CVE-2026-75842

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...

CVE-2026-75833

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75854

ArcadeDB versions before 26.8.1 expose a missing authentication flaw in the Redis wire-protocol plugin. Network attackers can connect to the Redis port with no credentials and read, write, or delete data across any server database, scoring CVSS 9.8 (CRITICAL). No exploitation evidence is provided...

CVE-2026-75854

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

EUVD-2026-60615

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75853

The com.arcadedb:arcadedb-gremlin plugin (≤26.7.3) enforces SASL PLAIN authentication but skips authorization: it never calls canAccessToDatabase or binds the principal, so any valid credential can read, write, and drop data in any database via a traversal-source alias, bypassing all per-type/rea...

EUVD-2026-60614

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75853

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...

CVE-2026-75852

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. CVSS 9.8 (Critical)...

CVE-2026-75852

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...