CVE-2026-87744Critical· 9.1▾ MidnightA flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without expli…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94451Medium· 6.5Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities
CVE-2026-106073Low· 3.3nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
CVE-2026-15577Medium· 6.5A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization)
CVE-2026-64676Medium· 5.7Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers
CVE-2026-116497Medium· 5.5Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon
CVE-2026-92171Medium· 6.5Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store