CVE-2026-52831High· 8.0▾ TwilightNuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
8 → 10
high → critical
10 → 8
critical → high
8 → 10
high → critical
10 → 8
critical → high
8 → 10
high → critical
10 → 8
critical → high
0.3% → 0.5%
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/nuclio/nuclio < 0.0.0-20260601075854-3356b86a8bfaPatched in:
github.com/nuclio/nuclio 0.0.0-20260601075854-3356b86a8bfaField changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-52833High· 8.0Nuclio is a "Serverless" framework for Real-Time Events and Data Processing
CVE-2026-52832Medium· 4.9Nuclio is a "Serverless" framework for Real-Time Events and Data Processing
CVE-2022-33186Critical· 9.8A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling …
CVE-2022-37902High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2022-37899High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2022-37900High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface