Approved changes feed: RSS · Atom
cpe:2.3:a:orneryd:nornicdb:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Orneryd (7810537f-b53c-55bc-91f3-14e6414373ea) |
|---|---|
| Product | Nornicdb (9ae82cad-c382-5fc5-be99-2d709e8c145f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42072 |
vulnerable | 2026-06-08 08:03:15.901445 |
Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access
CRITICAL (9.8)
Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.
Published: 2026-05-08T15:59:42.544Z
Updated: 2026-05-12T02:04:18.612Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.