Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that...
CVE-2026-73530
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to rea
#severity:medium
共收录 5494 条相关情报。
← 返回所有主题Elasticsearch does not validate a size value taken from a user-supplied input before that value...
CVE-2026-72678
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memor
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of...
CVE-2026-72674
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to...
CVE-2026-72676
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern...
CVE-2026-72679
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an interva
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics...
CVE-2026-72673
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Access
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend...
CVE-2026-72664
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on manag
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing...
CVE-2026-72661
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Co
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input...
CVE-2026-72663
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized...
CVE-2026-72666
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against El
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of...
CVE-2026-72659
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive All
A Kibana Machine Learning capability that removes a saved object from the current space accepts...
CVE-2026-72671
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can...
CVE-2026-72660
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of...
CVE-2026-72667
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an...
CVE-2026-72640
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manage
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of...
CVE-2026-72645
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to...
CVE-2026-72657
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipu
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the...
CVE-2026-72655
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management function
vLLM: Completion prompt lists fan out into unbounded engine requests
CVE-2026-73559
## Summary The `/v1/completions` request model accepts `prompt` as a list of text prompts or a list of token-id prompts
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
CVE-2026-54249
### Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the a