Apache Storm supervisor page leaks other topologies (CVE-2026-94125)
An authenticated Nimbus user can see host, port, owner and resources for topologies they cannot read.
Stories per day · 30 days
3 RSS
Relatedauthorization-bypass2apache-storm1cert1cve-2026-167531data-exfiltration1hapi-fhir1healthcare1hl71information-disclosure1kv-cache1llm-inference1low-code1lowcoder1nimbus1prefix-sharing1timing-side-channel1
9 stories, newest first · one card per story
Stories tagged #multi-tenant
Mirage bounds LLM KV-cache timing leaks without blocking sharing
On a 500-sample corpus and three models, token-emission delays pushed leakage near random guessing with lower TTFT than baselines.
HAPI FHIR flaws allow cross-tenant reads, writes and gzip exhaustion
CISA issued four CVEs and CSAF advisory VA-26-294-01; a researcher reproduced all four on HAPI FHIR 8.10.0.
VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
CERT/CC says Lowcoder 2.4.10 lets admins or developers read and run other tenants' library queries.
3
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Attacker uploaded ASPX webshells to a shared parks-and-rec platform, hitting three servers and hunting cardholder data.
Introducing the Wiz Partner Alliance Managed Service Provider Program
Wiz opened a public-preview managed service provider program for scaled cloud and AI security delivery.
Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data
Cloudflare fixed a Containers flaw that exposed other customers' leftover disk data.
2
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
Cloudflare fixed a Containers flaw that could expose residual cross-tenant disk data; no malicious exploitation was found.
3
VU#889462: Casdoor authentication server is vulnerable to authorization bypass
Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.
3