Kibana 8.12.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-102 / ESA-2026-108)

The version of Kibana installed on the remote host is 8.12.x prior to 8.19.19, 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-102 and ESA-2026-108 advisories. - Missing Authorization CWE-862 in Kibana can lead to...

Linux Distros Unpatched Vulnerability : CVE-2026-7485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted ho...

Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-124)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-124 advisory. - Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user...

PT-2026-79431

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

PT-2026-82767

Name of the Vulnerable Software and Affected Versions Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6 Description The Monitor subscription handler fails to properly authorize access to the configuration-key store. A CephX user with mon allow r capabilities can read the entire store by...

PT-2026-82325

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40 Description The filer's TUS resumable-upload handler fails to verify JWT allowed prefixes scoping after a session is created. This allows a low-privilege tenant who obtains another user's session identifier to...

PT-2026-79317

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Insufficient access control validation in several userdata-related APIs may allow unauthorized cross-tenant or cross-account...

Kibana 8.x < 8.19.20 / 9.x < 9.4.4 Incorrect Authorization (ESA-2026-90)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-90 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations...

Kibana 8.19.x < 8.19.20 / 9.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-126 / ESA-2026-127 / ESA-2026-129)

The version of Kibana installed on the remote host is 8.19.x prior to 8.19.20, 9.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-126, ESA-2026-127 and ESA-2026-129 advisories. - Incorrect Authorization CWE-863 in Kiba...

Kibana 8.5.x < 8.19.20 / 9.x < 9.4.5 Missing Authorization (ESA-2026-96)

The version of Kibana installed on the remote host is 8.5.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-96 advisory. - Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend...

Kibana 8.9.x < 8.19.20 / 9.x < 9.4.5 Missing Authorization (ESA-2026-95)

The version of Kibana installed on the remote host is 8.9.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-95 advisory. - Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response...

CVE-2026-69558

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-69555

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-49217

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

CVE-2026-49217

Mailu , a mail server distributed as Docker images, is affected by a missing authorization check in its admin REST API prior to version 2024.06.52 . When the REST API is enabled, an unauthenticated remote attacker can remove IP restrictions or modify the comment field on any existing user token v...

CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

EUVD-2026-63743

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

CVE-2026-72843 EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

CVE-2026-72843 EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

EUVD-2026-63639

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...