Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing...
CVE-2026-72661
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Co
2026-08-14 归档
今日共收录 1589 条安全情报，包含 784 个 CVE，406 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input...
CVE-2026-72663
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized...
CVE-2026-72666
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against El
A lower privileged user who holds only the privilege to read agent policies can read the entire...
CVE-2026-72670
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a confi
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of...
CVE-2026-72659
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive All
A Kibana Machine Learning capability that removes a saved object from the current space accepts...
CVE-2026-72671
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can...
CVE-2026-72660
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site...
CVE-2026-72658
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and...
CVE-2026-72665
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response acti
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who...
CVE-2026-72669
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of...
CVE-2026-72667
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of...
CVE-2026-72645
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to...
CVE-2026-72657
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipu
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the...
CVE-2026-72655
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management function
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
CVE-2026-73654
## Summary The run-metadata update endpoint `PUT /api/v1/runs/:runId/metadata` applies client-supplied "operations" by
vLLM: Completion prompt lists fan out into unbounded engine requests
CVE-2026-73559
## Summary The `/v1/completions` request model accepts `prompt` as a list of text prompts or a list of token-id prompts
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
CVE-2026-54526
### Summary The allow-list fix for CVE-2026-31892 (GHSA-3wf5-g532-rcrr), and its follow-up coverage of `hostNetwork`/`s
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
CVE-2026-55072
### Summary A missing end anchor (`$`) in the ClassDefinition UID validation regex allows an authenticated user with the
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
CVE-2026-55074
Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
CVE-2026-55071
## Stata Command Injection via Unsanitized `package` in `ado_package_install` ### Summary The `ado_package_install` MC