Every CVE Search/ Get API key

CVE-2025-24978

LF Edge eKuiper: Self-XSS in External Service Creation

3.7 LowFix available

Summary

A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces.

Details

Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as <iframe src="...">). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session.

PoC

  1. Create an external service JSON definition with a filename containing an XSS payload, e.g. <iframe src="javascript:alert1337">.json inside a ZIP archive.
  2. In external service creation, upload the ZIP and provide the matching service name: <iframe src="javascript:alert1337">.
  3. Upon service registration, the unescaped name executes when rendered in the UI context.

Impact

Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session.

Remediation & Patches

  • Upgrade to eKuiper >= 2.4.0: Strict alphanumeric identifier validation (validate.ValidateID) is now enforced on all external service creation and update endpoints, rejecting invalid characters.

Workarounds

  • Protect eKuiper management endpoints (POST /services) with authentication and network-level firewalls.

Credits

  • Reported by Alexey Kosmachev, Bi.Zone (@TheMostKnown)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

What each source reports

GitHub Advisories Score usedGHSA-g8rh-fjm6-h2h9 3.7

LF Edge eKuiper: Self-XSS in External Service Creation

Summary

A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces.

Details

Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as <iframe src="...">). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session.

PoC

  1. Create an external service JSON definition with a filename containing an XSS payload, e.g. <iframe src="javascript:alert1337">.json inside a ZIP archive.
  2. In external service creation, upload the ZIP and provide the matching service name: <iframe src="javascript:alert1337">.
  3. Upon service registration, the unescaped name executes when rendered in the UI context.

Impact

Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session.

Remediation & Patches

  • Upgrade to eKuiper >= 2.4.0: Strict alphanumeric identifier validation (validate.ValidateID) is now enforced on all external service creation and update endpoints, rejecting invalid characters.

Workarounds

  • Protect eKuiper management endpoints (POST /services) with authentication and network-level firewalls.

Credits

  • Reported by Alexey Kosmachev, Bi.Zone (@TheMostKnown)
Record
GHSA-g8rh-fjm6-h2h9
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-g8rh-fjm6-h2h9 3.7

LF Edge eKuiper: Self-XSS in External Service Creation

Summary

A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces.

Details

Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as <iframe src="...">). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session.

PoC

  1. Create an external service JSON definition with a filename containing an XSS payload, e.g. <iframe src="javascript:alert1337">.json inside a ZIP archive.
  2. In external service creation, upload the ZIP and provide the matching service name: <iframe src="javascript:alert1337">.
  3. Upon service registration, the unescaped name executes when rendered in the UI context.

Impact

Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session.

Remediation & Patches

  • Upgrade to eKuiper >= 2.4.0: Strict alphanumeric identifier validation (validate.ValidateID) is now enforced on all external service creation and update endpoints, rejecting invalid characters.

Workarounds

  • Protect eKuiper management endpoints (POST /services) with authentication and network-level firewalls.

Credits

  • Reported by Alexey Kosmachev, Bi.Zone (@TheMostKnown)
Record
GHSA-g8rh-fjm6-h2h9
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGO-2026-6446 No score

LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper

LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper

Record
GO-2026-6446
Updated
2026-11-02
OSVopenSUSE-SU-2026:21897-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
openSUSE-SU-2026:21897-1
Updated
2026-11-02
OSVSUSE-SU-2026:23855-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23855-1
Updated
2026-11-02
OSVSUSE-SU-2026:23863-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23863-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
github.com/lf-edge/ekuiper/v2
Go
 before 2.4.0
2.4.0
github.com/lf-edge/ekuiper
Go
 All versions None known
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-24978 is a low vulnerability (CVSS 3.7) in github.com/lf-edge/ekuiper/v2, published September 9, 2026. No source lists public exploit code. Fixed in github.com/lf-edge/ekuiper/v2 2.4.0.

References

Show 91 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open