CVE-2024-49587

The record

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances

Affected packages

Related vulnerabilities

• CVE-2026-88837 BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic… CWE-305
• CVE-2026-86207 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in… CWE-305
• CVE-2026-16895 A logic vulnerability (fail-open condition) has been identified within the Metasploit… CWE-305
• CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code… CWE-305
• CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from… CWE-305
• CVE-2026-1621 Authentication bypass by primary weakness vulnerability in Universal Software Inc. CWE-305
• CVE-2026-65935 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by… CWE-305
• CVE-2026-19292 Re-pairing with a legitimate device can use a lower security level than previous making… CWE-305