9337 matches found
CVE-2026-72680
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
CVE-2026-72680
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
CVE-2026-72680
Summary: CVE-2026-72680 affects Kibana Agent Builder via the A2A JSON-RPC API. An authenticated user with only read privileges can supply a user-owned identifier for a conversation that already exists in the same space and cause that conversation to be replaced and reassigned to the attacker, res...
CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
CVE-2026-73561
Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. Th...
CVE-2026-73561 Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. Th...
CVE-2026-73561 Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. Th...
CVE-2026-73561
CVE-2026-73561 describes an unauthenticated DoS in the Hub Node.js WebSocket server. For every new WebSocket, Hub registers a listener that triggers an RPC path: get-client-id is sent via RPC, the request is stored in RPC.requests, and a polling interval (setInterval every 10 ms) checks for a mat...
CVE-2026-73561 Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. Th...
MAL-2026-13957 Malicious code in postcss-initialize-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79 postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from...
Malicious code in postcss-initialize-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79 postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from...
Kibana 9.4.5 Security Update (ESA-2026-82)
Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...
PT-2026-71790
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description The Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from user-supplied input. The ownership check for this identifier fails to distinguish between a...
CVE-2026-72680: Authorization Bypass Through User-Controlled Key
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
CVE-2026-62781
Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...
CVE-2026-42976
Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally...
CVE-2026-62781
CVE-2026-62781 is a heap-based buffer overflow in the RPC Runtime Library that enables remote code execution over the network. The vulnerability allows an unauthenticated attacker to run code on affected systems via network interaction. Current documents confirm the issue but do not provide produ...