Cribl
Monthly
Arbitrary code execution in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to compromise the server. The attacker can execute arbitrary code as the Cribl server process by importing a crafted Git repository containing a symbolic link in the pack's functions directory. No public exploit is known, and there is no evidence of active exploitation at this time.
Arbitrary JavaScript execution in Cribl Stream before 4.18.2 allows authenticated attackers with edit privileges to run arbitrary code on the server via crafted database connection identifiers or pack configuration values. The vulnerability stems from improper code generation in the JSON Pointer-to-accessor compiler. No public exploit or active exploitation has been reported.
Local privilege-bound input validation flaw in Cribl Edge versions prior to 4.17.1 allows an authenticated low-privileged local user to achieve high impact on confidentiality, integrity, and availability of the affected node. The issue is tracked as CWE-20 (Improper Input Validation) and was reported by Cribl itself with a vendor patch already available; no public exploit identified at time of analysis and EPSS is very low at 0.02%.
Information disclosure in Cribl Stream versions prior to 4.17.1 allows authenticated remote attackers with low privileges to obtain sensitive data when a user interacts with attacker-supplied content, per CVSS 4.0 vector AV:N/AC:L/PR:L/UI:A. The flaw, classified as CWE-20 (Improper Input Validation), carries a CVSS base score of 8.4 reflecting high confidentiality and integrity impact, but EPSS is only 0.02% (5th percentile) and CISA SSVC reports no observed exploitation. No public exploit identified at time of analysis.
Local privilege-context input validation flaw in Cribl Edge versions prior to 4.17.1 allows an authenticated local user with low privileges to compromise confidentiality, integrity, and availability of the Edge node. Tagged as an information disclosure issue by the vendor, the vulnerability scores CVSS 4.0 8.5 (high) but carries a very low EPSS of 0.02%, and no public exploit identified at time of analysis. A vendor patch is available and the issue is tracked as EUVD-2026-29355.
Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary code execution in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to compromise the server. The attacker can execute arbitrary code as the Cribl server process by importing a crafted Git repository containing a symbolic link in the pack's functions directory. No public exploit is known, and there is no evidence of active exploitation at this time.
Arbitrary JavaScript execution in Cribl Stream before 4.18.2 allows authenticated attackers with edit privileges to run arbitrary code on the server via crafted database connection identifiers or pack configuration values. The vulnerability stems from improper code generation in the JSON Pointer-to-accessor compiler. No public exploit or active exploitation has been reported.
Local privilege-bound input validation flaw in Cribl Edge versions prior to 4.17.1 allows an authenticated low-privileged local user to achieve high impact on confidentiality, integrity, and availability of the affected node. The issue is tracked as CWE-20 (Improper Input Validation) and was reported by Cribl itself with a vendor patch already available; no public exploit identified at time of analysis and EPSS is very low at 0.02%.
Information disclosure in Cribl Stream versions prior to 4.17.1 allows authenticated remote attackers with low privileges to obtain sensitive data when a user interacts with attacker-supplied content, per CVSS 4.0 vector AV:N/AC:L/PR:L/UI:A. The flaw, classified as CWE-20 (Improper Input Validation), carries a CVSS base score of 8.4 reflecting high confidentiality and integrity impact, but EPSS is only 0.02% (5th percentile) and CISA SSVC reports no observed exploitation. No public exploit identified at time of analysis.
Local privilege-context input validation flaw in Cribl Edge versions prior to 4.17.1 allows an authenticated local user with low privileges to compromise confidentiality, integrity, and availability of the Edge node. Tagged as an information disclosure issue by the vendor, the vulnerability scores CVSS 4.0 8.5 (high) but carries a very low EPSS of 0.02%, and no public exploit identified at time of analysis. A vendor patch is available and the issue is tracked as EUVD-2026-29355.
Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.