vulnerability · Thu 08 Oct 2026 · 22:09 UTC
GHSA-w294-6q5q-53p8: Hazelcast has an authorization bypass in IMap Predicates API
Filed UTCSource GTH ↗
Missing authorization checks in the [Predicates API](https://docs.hazelcast.com/hazelcast/5.7/query/predicate-overview) may allow a malicious client to execute arbitrary code on a Hazelcast member. ### Patches Enterprise customers should upgrade to a fixed version of Hazelcast Enterprise Edition: * 5.7.0 * 5.6.1 * 5.5.10 * 5.4.5 Customers with extended support contracts should contact Hazelcast Support for information on patches for older versions. Community Edition users should upgrade to version 5.7.0. …
Signals
as the pipeline stamped them- High
- High-risk vulnerability
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-107725 | — | 0.39% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.