3159 matches found
PT-2026-71771
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An issue exists where a Kibana visualization feature does not correctly validate malformed payloads submitted by authenticated users with low-privileged access. This leads to unbounded memory...
CVE-2026-72658: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...
CVE-2026-72659: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly...
CVE-2026-72663: Inefficient Algorithmic Complexity
Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the...
PT-2026-71770
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Cross-Site Request Forgery CSRF allows a user with permissions to create visualizations to save a specially crafted Vega visualization. When another user opens this visualization, it triggers...
PT-2026-71774
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Inefficient Algorithmic Complexity in Kibana allows for a denial of service through input data manipulation. A specially crafted, deeply nested expression submitted to a Kibana TSVB...
CVE-2026-72751
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
EUVD-2026-55633
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
[SECURITY] Fedora 43 Update: polymake-4.15-6.fc43
Polymake is a tool to study the combinatorics and the geometry of convex polytopes and polyhedra. It is also capable of dealing with simplicial complexes, matroids, polyhedral fans, graphs, tropical objects, and so forth. Polymake can use various computational packages if they are installed. Thos...
[SECURITY] Fedora 44 Update: polymake-4.15-11.fc44
Polymake is a tool to study the combinatorics and the geometry of convex polytopes and polyhedra. It is also capable of dealing with simplicial complexes, matroids, polyhedral fans, graphs, tropical objects, and so forth. Polymake can use various computational packages if they are installed. Thos...
Server-side Request Forgery (SSRF)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the renderVegaVisualization process. An attacker can cause a victim's browser to make arbitrary outbound GET requests and read responses from same-origin or CORS-permissiv...
CVE-2026-59939 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
GHSA-J5G9-F88F-GFJ3 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
Siemens Teamcenter Visualization 2412.x < 2412.0012 / 2506.x < 2506.0009 / 2512.x < 2512.2605 Privilege Escalation (SSA-288252)
The version of Siemens Teamcenter Visualization installed on the remote host is 2412.x prior to 2412.0012, 2506.x prior to 2506.0009, or 2512.x prior to 2512.2605. It is, therefore, affected by a vulnerability: - Untrusted search path in IAM Client SDK may allow an authenticated user to potential...
EUVD-2026-49585
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...
CVE-2026-66824
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...
CVE-2026-66824
CVE-2026-66824 is a stored XSS vulnerability in the capture tree visualization page. The app embeds the serialized capture tree directly into an inline JavaScript block via the Jinja safe filter. Attackers can craft values from captured content that terminate the [removed] tag and inject arbitrar...
CVE-2026-66824: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...
