https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:31:43 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00610 bdu:2026-00610 https://cve.radiocsirt.org/vuln/bdu:2026-00610 https://cve.radiocsirt.org/vuln/cnvd-2026-09794 cnvd-2026-09794 https://cve.radiocsirt.org/vuln/cnvd-2026-09794 https://cve.radiocsirt.org/vuln/euvd-2026-270972 EUVD-2026-270972 https://cve.radiocsirt.org/vuln/euvd-2026-270972 https://cve.radiocsirt.org/vuln/fkie_cve-2025-60021 <p>Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions &lt; 1.15.0)) on all platforms allows attacker to inject remote command.</p> <p>Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..</p> <p>Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.</p> <p>How to Fix: we provide two methods, you can choose one of them:</p> <p>1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.</p> <p>Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions &lt; 1.15.0)) on all platforms allows attacker to inject remote command.</p> <p>Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..</p> <p>Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.</p> <p>How to Fix: we provide two methods, you can choose one of them:</p> <p>1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-60021 https://cve.radiocsirt.org/vuln/ghsa-v93j-9rf6-jx2r <p>Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions &lt; 1.15.0)) on all platforms allows attacker to inject remote command.</p> <p>Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..</p> <p>Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.</p> <p>How to Fix: we provide two methods, you can choose one of them:</p> <p>1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.</p> <p>Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions &lt; 1.15.0)) on all platforms allows attacker to inject remote command.</p> <p>Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..</p> <p>Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.</p> <p>How to Fix: we provide two methods, you can choose one of them:</p> <p>1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.</p> https://cve.radiocsirt.org/vuln/ghsa-v93j-9rf6-jx2r