Posted by Yash Mayya on Oct 30 Severity: moderate Affected versions: - Apache Pinot 0.7.0 before 1.6.0 Description: Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table with a string literal argument rather than through the FROM clause, so...
CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/452
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API
Posted by Terence Monteiro on Oct 29 Severity: important Affected versions: - Apache Fineract through 1.15.0 Description: Improper Neutralization of Special Elements…
Multiple vulnerabilities in Suricata before 8.0.8
Posted by Victor Julien on Oct 29 Suricata 8.0.8 was released addressing a number of vulnerabilities. - HIGH: tftp: unbounded transaction retention can cause CPU…
Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’
The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites…
The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO
The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites…
CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
Posted by Manikumar on Oct 28 Severity: low Affected versions: - Apache Kafka 2.4.0 before 4.2.2 - Apache Kafka 4.3.0 before 4.3.2 Description: Apache Kafka Connect…
Multiple vulnerabilities in Jenkins
Posted by Kevin Guerroudj on Oct 28 Jenkins is an open source automation server which enables developers around the world to reliably build, test, and deploy their…