HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-18618 — A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs

Analysis

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace. CVSS Score: 7.5. Published: 2026-08-10T21:17:20.370.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18618
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 10, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-74790 — Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering...

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.

CVE-2026-74790
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-73061 — Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedOb...

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

CVE-2026-73061
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-73056 — SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive...

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an

CVE-2026-73056
NIST NVD