116 matches found
CVE-2026-20253
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.The vulnerability exists because the PostgreSQL sidecar...
CVE-2026-20253
CVE-2026-20253 affects Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14. The PostgreSQL sidecar service endpoint lacks authentication, allowing any network-reachable user to create or truncate arbitrary files. Remediation: u...
CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.The vulnerability exists because the PostgreSQL sidecar...
EUVD-2026-36088
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.The vulnerability exists because the PostgreSQL sidecar...
CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.The vulnerability exists because the PostgreSQL sidecar...
PT-2026-48493
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Cloud Platform versions prior to 10.4.2604.3 Splunk Cloud Platform versions prior to 10.2.2510.14 Description An unauthenticated user can create or...
PT-2026-48512
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result...
Splunk Enterprise 10.0.0 < 10.0.7, 10.2.0 < 10.2.4 (SVD-2026-0603)
The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0603 advisory. - In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14,...
PT-2026-46857
Impact Any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment e.g., following the production Docker example in the README, this is exploitable from the local network without...
hermes-sidecar-poc
Hermes PoC — Pod + Nacos + Math microservice Dubbo Triple S...
Directory Traversal
Overview psitransfer is a Simple open source self-hosted file sharing solution Affected versions of this package are vulnerable to Directory Traversal through the Store.getFilename path resolution in the upload storage component. An attacker can escape the upload jail and read or overwrite files...
EUVD-2026-24217
Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers /api/state, /api/restore, and /api/history-svg that process incoming requests by accumulating the entire request body into a...
Empowering Mobile Networks Security Resilience by Using Post-Quantum Cryptography
The transition to a cloud-native 5G Service-Based Architecture SBA improves scalability but exposes control-plane signaling to emerging quantum threats, including Harvest-Now, Decrypt-Later HNDL attacks. While NIST has standardized post-quantum cryptography PQC, practical, deployable integration ...
OpenClaw PRISM: A Zero-Fork, Defense-In-Depth Runtime Security Layer for Tool-Augmented LLM Agents
Tool-augmented LLM agents introduce security risks that extend beyond user-input filtering, including indirect prompt injection through fetched content, unsafe tool execution, credential leakage, and tampering with local control files. We present OpenClaw PRISM, a zero-fork runtime security layer...
GHSA-8398-GMMX-564H n8n has a Python sandbox escape
Impact A vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. Only authenticated users are able to execute code through Task Runners. This issue affected any deployment in which the...
n8n has a Python sandbox escape
Impact A vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. Only authenticated users are able to execute code through Task Runners. This issue affected any deployment in which the...
CVE-2026-23490 vulnerabilities
Vulnerabilities for packages: k8s-sidecar, kubeflow-pipelines-visualization-server, open-webui, airflow, kubeflow-katib, py3-cassandra-medusa, kubeflow-volumes-web-app, kubeflow-pipelines, superset, kserve, dask-kubernetes, kubeflow-jupyter-web-app, mlflow...
GHSA-63VM-454H-VHHQ vulnerabilities
Vulnerabilities for packages: k8s-sidecar, kubeflow-pipelines-visualization-server, open-webui, airflow, kubeflow-katib, py3-cassandra-medusa, kubeflow-volumes-web-app, kubeflow-pipelines, superset, kserve, dask-kubernetes, kubeflow-jupyter-web-app, mlflow...
GHSA-63VM-454H-VHHQ vulnerabilities
Vulnerabilities for packages: kserve, gitlab-cng, metaflow-service, mlflow, spamcheck, kubeflow-pipelines-visualization-server, authentik, label-studio, ansible-operator, gitlab-cng-fips, kubeflow-volumes-web-app, dbt-bigquery, kubeflow-jupyter-web-app, airflow, localstack, barman,...
CVE-2026-23490 vulnerabilities
Vulnerabilities for packages: kserve, gitlab-cng, metaflow-service, mlflow, spamcheck, kubeflow-pipelines-visualization-server, authentik, label-studio, ansible-operator, gitlab-cng-fips, kubeflow-volumes-web-app, dbt-bigquery, kubeflow-jupyter-web-app, airflow, localstack, barman,...