CVE-2026-115292: Elastic Kibana: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information…

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with Machine Learning read access in one Kibana space can read the audit and error...

CVE-2026-115293: Elastic Kibana: Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure…

Insertion of Sensitive Information Into Sent Data CWE-201 in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated use...

CVE-2026-112354: Etrel d.o.o. Etrel INCH: Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a…

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over...

CVE-2026-113421: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full…

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-110288: GitHub Enterprise Server: A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated…

A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a...

CVE-2026-95750: Hewlett Packard Enterprise (HPE) Fabric Composer: An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated…

An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive...

CVE-2026-95734: Hewlett Packard Enterprise (HPE) Fabric Composer: A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an…

A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtai...

CVE-2026-95775: Hewlett Packard Enterprise (HPE) Fabric Composer: A local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

A local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to read certain files on the underlying operating system...

CVE-2026-95774: Hewlett Packard Enterprise (HPE) Fabric Composer: A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer

A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information from the affected system...

CVE-2026-95777: Hewlett Packard Enterprise (HPE) Fabric Composer: A sensitive information disclosure vulnerability exists in the management interface of HPE Networking Fabric Composer

A sensitive information disclosure vulnerability exists in the management interface of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged attacker to obtain certain sensitive information stored on the affected system...

CVE-2026-95749: Hewlett Packard Enterprise (HPE) Fabric Composer: A missing integrity verification vulnerability exists in HPE Networking Fabric Composer

A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system...

CVE-2026-95755: Hewlett Packard Enterprise (HPE) Fabric Composer: Improper certificate validation vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow…

Improper certificate validation vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept management traffic if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an...

CVE-2026-95737: Hewlett Packard Enterprise (HPE) Fabric Composer: A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system...

CVE-2026-95741: Hewlett Packard Enterprise (HPE) Fabric Composer: A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer

A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged authenticated attacker to gain elevated privileges on the affected system...

CVE-2026-95742: Hewlett Packard Enterprise (HPE) Fabric Composer: An arbitrary file write vulnerability exists in the underlying operating system of HPE Networking Fabric Composer

An arbitrary file write vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated local attacker to create or overwrite arbitrary files on the affected system with elevated privileges...

CVE-2026-97072: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2...

CVE-2026-103327: Unknown CryptoCloud: The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications…

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary...

CVE-2026-103379: Unknown WATI Chat and Notification: The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public…

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order...

CVE-2026-77799: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows…

ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code...

CVE-2026-121736: nocodb: NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize…

NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert...