CVE-2026-34214High· 7.7▾ TwilightTrino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.
trino >= 439, < 480Upgrade past the affected range:
trino 480Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7163Medium· 6.1A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrativ…
CVE-2026-67221Medium· 5.9RabbitMQ is a messaging and streaming broker
CVE-2026-96549Low· 3.3A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8
CVE-2026-77250Medium· 6.1MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)
CVE-2026-90860High· 7.1The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView
CVE-2026-93764Medium· 6.5Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema