Threat database

48 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	5.9	EPSS 0.5%	CVE-2026-42316kafka-sink-azure-kusto · Improper Neutralization of Special Elements in Data Query Logic Medium5.9EPSS 0.5%2026-05-11CVE Database V5CVE-2026-42316 kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer (Kusto). Prior to 5.2.3, kafka-sink-azure-kusto did not sanitize user-controlled values inside the kusto.tables.topics.mapping configuration. The db, table, mapping, and format fields of each mapping entry were interpolated directly into KQL management/query commands via String.formatted(...) (e.g., FETCH_TABLE_COMMAND.formatted(table) → "<table> \| count", FETCH_TABLE_MAPPING_COMMAND.formatted(table, format, mapping) → ".show table <table> ingestion <format> mapping '<mapping>'"). An actor able to influence the connector configuration (for example, someone with permissions to submit or edit Kafka Connect connector configs) could embed KQL metacharacters (;, \|, ') to execute arbitrary management commands in the context of the connector's service principal — enabling schema enumeration/modification, ingestion-mapping tampering, or changes to streaming/retention policies on the target Azure Data Explorer database. This is a tampering vulnerability. Exploitation requires privileged access to the connector configuration; no end-user interaction or Kafka record payload is involved. This vulnerability is fixed in 5.2.3. EPSS 0.5%Vulnerability Azure #cwe-943	CVE Database V5	2026-05-11
Medium	5.3	EPSS 1.5%	CVE-2026-32952go-ntlmssp · Integer Overflow or Wraparound Medium5.3EPSS 1.5%2026-04-24CVE Database V5CVE-2026-32952 CVE-2026-32952 is a medium severity vulnerability in the Azure go-ntlmssp Go package prior to version 0.1.1. It involves an integer overflow or wraparound (CWE-190) that can cause a slice out of bounds panic when processing a malicious NTLM challenge message. This panic can crash any Go process using ntlmssp. Negotiator as an HTTP transport. The issue is patched in version 0.1.1. No known exploits are reported in the wild. EPSS 1.5%Vulnerability Azure #cwe-190	CVE Database V5	2026-04-24
Low	2.3	EPSS 0.3%	CVE-2025-12603BLU-IC2 · Out-of-bounds Write Low2.3EPSS 0.3%2025-11-01CVE Database V5CVE-2025-12603 /etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.3%Vulnerability Azure Access Technology #cwe-787 Germany+4	CVE Database V5	2025-11-01
Low	2.3	EPSS 0.3%	CVE-2025-12602BLU-IC2 · Out-of-bounds Write Low2.3EPSS 0.3%2025-11-01CVE Database V5CVE-2025-12602 /etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.3%Vulnerability Azure Access Technology #cwe-787 Germany+4	CVE Database V5	2025-11-01
Critical	10.0	EPSS 0.3%	CVE-2025-12601BLU-IC2 · Denial of Service Critical10.0EPSS 0.3%2025-11-01CVE Database V5CVE-2025-12601 Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.3%Vulnerability Azure Access Technology #cwe-730 Germany+5	CVE Database V5	2025-11-01
Critical	10.0	EPSS 0.4%	CVE-2025-12600BLU-IC2 · Denial of Service Critical10.0EPSS 0.4%2025-11-01CVE Database V5CVE-2025-12600 Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.4%Vulnerability Azure Access Technology #cwe-730 Germany+5	CVE Database V5	2025-11-01
Critical	10.0	EPSS 0.4%	CVE-2025-12599BLU-IC2 · Use of Hard-coded Cryptographic Key Critical10.0EPSS 0.4%2025-11-01CVE Database V5CVE-2025-12599 Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.4%Vulnerability Azure Access Technology #cwe-321 Germany+6	CVE Database V5	2025-11-01
Medium	6.9	EPSS 0.4%	CVE-2025-12554BLU-IC2 · Protection Mechanism Failure Medium6.9EPSS 0.4%2025-10-31CVE Database V5CVE-2025-12554 Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.4%Vulnerability Azure Access Technology #cwe-693 Germany+5	CVE Database V5	2025-10-31
Critical	10.0	EPSS 0.2%	CVE-2025-12553BLU-IC2 · Missing Validation of OpenSSL Certificate Critical10.0EPSS 0.2%2025-10-31CVE Database V5CVE-2025-12553 Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.2%Vulnerability Azure Access Technology #cwe-599 Germany+9	CVE Database V5	2025-10-31
Medium	6.9	EPSS 0.3%	CVE-2025-12552BLU-IC2 · Weak Password Requirements Medium6.9EPSS 0.3%2025-10-31CVE Database V5CVE-2025-12552 Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. EPSS 0.3%Vulnerability Azure Access Technology #cwe-521 Germany+6	CVE Database V5	2025-10-31
Low	2.1	EPSS 0.2%	CVE-2025-12517BLU-IC2 · Obsolete Feature in UI Low2.1EPSS 0.2%2025-10-30CVE Database V5CVE-2025-12517 Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.2%Vulnerability Azure Access Technology #cwe-448 Germany+5	CVE Database V5	2025-10-30
Critical	10.0	EPSS 0.4%	CVE-2025-12516BLU-IC2 · Unexpected Status Code or Return Value Critical10.0EPSS 0.4%2025-10-30CVE Database V5CVE-2025-12516 Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.4%Vulnerability Azure Access Technology #cwe-394 Germany+6	CVE Database V5	2025-10-30
Critical	10.0	EPSS 0.4%	CVE-2025-12515BLU-IC2 · Unexpected Status Code or Return Value Critical10.0EPSS 0.4%2025-10-30CVE Database V5CVE-2025-12515 Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.4%Vulnerability Azure Access Technology #cwe-394 Germany+6	CVE Database V5	2025-10-30
Critical	10.0	EPSS 0.2%	CVE-2025-12479BLU-IC2 · Cross-Site Request Forgery (CSRF) Critical10.0EPSS 0.2%2025-10-29CVE Database V5CVE-2025-12479 Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.2%Vulnerability Azure Access Technology #cwe-352 Germany+6	CVE Database V5	2025-10-29
Critical	10.0	EPSS 0.2%	CVE-2025-12478BLU-IC2 · Inadequate Encryption Strength Critical10.0EPSS 0.2%2025-10-29CVE Database V5CVE-2025-12478 Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.2%Vulnerability Azure Access Technology #cwe-326 Germany+6	CVE Database V5	2025-10-29
Critical	10.0	EPSS 0.3%	CVE-2025-12477BLU-IC2 · Missing Authentication for Critical Function Critical10.0EPSS 0.3%2025-10-29CVE Database V5CVE-2025-12477 Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.3%Vulnerability Azure Access Technology #cwe-306 Germany+6	CVE Database V5	2025-10-29
Critical	10.0	EPSS 0.3%	CVE-2025-12476BLU-IC2 · Missing Authentication for Critical Function Critical10.0EPSS 0.3%2025-10-29CVE Database V5CVE-2025-12476 Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.3%Vulnerability Azure Access Technology #cwe-306 Germany+6	CVE Database V5	2025-10-29
Critical	10.0	EPSS 0.2%	CVE-2025-12425BLU-IC2 · Improper Privilege Management Critical10.0EPSS 0.2%2025-10-28CVE Database V5CVE-2025-12425 Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.2%Vulnerability Azure Access Technology #cwe-269 Germany+9	CVE Database V5	2025-10-28
Critical	10.0	EPSS 0.3%	CVE-2025-12424BLU-IC2 · Improper Privilege Management Critical10.0EPSS 0.3%2025-10-28CVE Database V5CVE-2025-12424 Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.3%Vulnerability Azure Access Technology #cwe-269 Germany+9	CVE Database V5	2025-10-28
Critical	10.0	EPSS 0.3%	CVE-2025-12423BLU-IC2 · Uncaught Exception Critical10.0EPSS 0.3%2025-10-28CVE Database V5CVE-2025-12423 Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . EPSS 0.3%Vulnerability Azure Access Technology #cwe-248 Germany+5	CVE Database V5	2025-10-28

Showing 1–20 of 48 results