CVE-2026-94451

MediumCVSS 6.5/10Last modified Oct 16, 2026

Description

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 12, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-944537.5Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another pa CVE-2026-944557.1An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middle CVE-2026-944569.1Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used CVE-2026-944574.8Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.CVE-2026-94464.7A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the fil CVE-2026-944616.5Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.CVE-2026-944627.1Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associ CVE-2026-94477.3A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /us CVE-2026-94484.3A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.php CVE-2026-944828.2Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App CVE-2026-944836.5Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-cont CVE-2026-944844.8Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level