CVE-2026-90798

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 an...

CVE-2026-90798

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90798 Apache CouchDB: Replicator follows redirects indefinitely

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90798

Apache CouchDB versions 3.5.2 and below on all platforms are vulnerable to a denial of service (DoS) . The issue stems from a missing circuit-breaker in the replicator component, which allows an owner of a replication source or target to trigger an infinite HTTP redirect loop . Users are recommen...

CVE-2026-90798 Apache CouchDB: Replicator follows redirects indefinitely

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

EUVD-2026-105157

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

EUVD-2026-92131

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105165

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105165 devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105165 devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105165 devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105165

The devopspolis secrets-replicator (versions up to 0.4.0 ) is vulnerable to an issue in the AssumeRole Handler component. Specifically, the process_single_secret function in src/handler.py allows for incorrect permission assignment due to the manipulation of the external_id argument. This vulnera...

CVE-2026-105165: Incorrect Permission Assignment for Critical Resource

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

PT-2026-104651

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process single secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external id leads to incorrect permission assignment. The attack can be...

GO-2026-4601 vulnerabilities

Vulnerabilities for packages: gitness, cilium, bom, aws-application-networking-k8s, thanos-operator, kaniko, docker-cli, nri-apache, rancher-system-upgrade-controller, terraform-provider-google, kapp, smokescreen, step, tkn, cert-exporter, redpanda, kubo, oauth2-proxy, mongo-tools, azurefile-csi,...

GO-2026-5037 vulnerabilities

Vulnerabilities for packages: flux, terragrunt, aactl, crossplane-provider-azure-authorization, conftest, dapr, aws-flb-kinesis, cluster-api-helm-controller, kubeflow-pipelines, act, kubeflow-katib, kaniko, terraform-provider-azurerm, crossplane-provider-aws-ec2, frp, cluster-autoscaler,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: flux, terragrunt, aactl, crossplane-provider-azure-authorization, conftest, dapr, aws-flb-kinesis, cluster-api-helm-controller, kubeflow-pipelines, act, kubeflow-katib, kaniko, terraform-provider-azurerm, crossplane-provider-aws-ec2, frp, cluster-autoscaler,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kine, gitness, sbomqs, aactl, pvc-autoresizer, git-lfs, conftest, postgres-operator, aws-flb-kinesis, bom, crossplane-provider-aws-iam, rancher-loglevel, kubeflow-pipelines, kserve-modelmesh-serving, kubeflow-katib, mongodb-kubernetes-operator, thanos-operator,...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: policy-bot-fips, knative-serving, knative-net-istio-fips, helm-operator-fips, oauth2-proxy-fips, amazon-vpc-cni-plugins-fips, gogatekeeper, amass, commercial-spilo, crossplane-provider-aws-signer, vitess, cluster-api-azure-controller-fips, zabbix, infinispan-operator...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Lucene.Net.Replicator process. An attacker can access arbitrary files on the server by submitting crafted requests containing path traversal sequences. Details A Directory Traversal attack also known as path...