Apache Superset CTAS tmp_table_name SQL injection bypasses the allow_dml restriction

Apache Superset CTAS tmptablename SQL Injection Bypasses the allowdml Database Security Restriction ZAI-2026-IIRAQ1 Vulnerability Overview In Apache Superset's SQL Lab "save query result as table" CTAS/CVAS feature, the tmptablename parameter used to specify the target table name is neither...

AZL-95765 CVE-2026-70461 affecting package rsync for versions less than 3.5.0-1

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-137)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-81)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and...

CVE-2026-19182 OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLEREST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLEREADONLY, to modify alarm state despite the...

PT-2026-71789

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An issue exists where the software fails to apply configurable input length restrictions to user-supplied patterns used in intervals queries. A deeply nested pattern can cause unbounded...

CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

CVE-2026-49089: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

PT-2026-71765

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with read-only privileges to the alerting feature can cause a denial of service by submitting a specially crafted, malformed payload. This leads to excessive resource...

CVE-2026-19656

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user including one holding only low-privilege, read-only permissions to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the conte...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

EUVD-2026-57398

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

SUSE CVE-2026-68445

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4gemobjectmmap rejects a writable mapping of a validated shader BO, but leaves VMMAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotec...

CVE-2026-18171

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

CVE-2026-18171

CVE-2026-18171 affects Docker Sandboxes (sbx) where the read-only intent of a runtime host mount is applied only to the in-guest bind; the virtio-fs host-edge grant is added to the sandbox policy-share allowlist with no access mode. The result is that the directory remains writable at the shared-...

EUVD-2026-57236

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

CVE-2026-18171 Docker Sandboxes read-only runtime mount writable through its shared-export alias

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

CVE-2026-18171 Docker Sandboxes read-only runtime mount writable through its shared-export alias

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

DEBIAN-CVE-2026-68445

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4gemobjectmmap rejects a writable mapping of a validated shader BO, but leaves VMMAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotec...