CVE Watch12 de out. de 2026

CVE-2026-48106

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `i

CVSS

—

Sem CVSS

EPSS

0.2%

p13

KEV

—

Exploit Today

0-100

Publicado: 21 de ago. de 2026 · Última mod.: 12 de out. de 2026 · CWE-306 · CWE-345 · CWE-924

EPSS · 30d

0.2%EPSS · 30 dias0.2%

2026-10-082026-11-05

Descrição técnica

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any application-layer authentication — no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected `MsgReplicateSync` traffic, and/or disable cluster mode until the fix is available.

Referências oficiais

github.comhttps://github.com/Basekick-Labs/arc/security/advisories/GHSA-wfgr-8x84-22q7

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2025-66621—

—

———Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.8h CVE-2026-1232786.7 MÉD

—

———In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint9h CVE-2026-1232775.0 MÉD

—

———In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux9h CVE-2026-1216365.3 MÉD

—

———The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.8h CVE-2026-1216335.3 MÉD

—

———The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.8h CVE-2026-889825.4 MÉD

—

———Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0.21h