CVE-2026-5562 provectus kafka-ui Endpoint testexecutions validateAccess code injection

A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the component Endpoint. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and...

kafka-ui 代码注入漏洞

kafka-ui is a web management interface for Kafka developed by Provectus. Versions of kafka-ui prior to 0.7.2 contained a code injection vulnerability. This vulnerability stemmed from the validateAccess function in the endpoint/api/smartfilters/testexecutions...

Directus allows updates to non-allowed fields due to overlapping policies

Summary If there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is allowed to update the superset of fields allowed by any of the policies. E.g. have one policy...