380414 matches found
CVE-2026-101153 Security Advisory 0188
On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...
CVE-2026-101153
A path traversal vulnerability exists in CloudVision Portal (on-premises) and CloudVision Sensor . An authenticated user with high privileges could exploit this flaw to extract unintended data from the Sensor. The vulnerability is associated with CWE-22 (Improper Limitation of a Pathname to a Res...
CVE-2026-101153 Security Advisory 0188
On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...
EUVD-2026-93949
On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...
CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...
CVE-2026-102407
A vulnerability in Elasticsearch (CWE-863) allows an authenticated user with sufficient privileges over a single resource to modify a data stream to which they are not authorized. By using the Modify Data Streams API , an attacker can potentially inject data or affect searchability, though they c...
CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...
EUVD-2026-93928
Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...
EUVD-2026-93927
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...
CVE-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...
CVE-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...
CVE-2026-102406
A CWE-639 Authorization Bypass in Kibana allows users with delegated Fleet package-management privileges to claim a data stream identifier already in use by another tenant. Because ownership is not verified before Fleet applies settings from an uploaded package, an attacker can redirect another t...
DEBIAN-CVE-2026-106398
Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-106398
Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
DEBIAN-CVE-2026-106394
Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...
DEBIAN-CVE-2026-106392
Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-106394
Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...
CVE-2026-106392
Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...