GO-2023-2042 vulnerabilities

Vulnerabilities for packages: metrics-server...

CVE-2026-72675

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

CVE-2026-72630

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-72630

CVE-2026-72630 affects Kibana Fleet with Incorrect Authorization (CWE-863) causing privilege escalation (CAPEC-122). Root cause: during updates, Fleet validates the integration policy restriction against the stored policy’s integration instead of the replacement integration, allowing a user with ...

EUVD-2026-58290

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-72630 Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-72675

CVE-2026-72675 concerns Kibana’s Machine Learning: missing authorization allows cross-space information disclosure and unauthorized data modification due to some Elasticsearch operations running with elevated internal permissions and insufficient per-request space filtering. The issue affects Kib...

CVE-2026-72675 Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An integer overflow or...

CVE-2026-48440 ColdFusion | Heap-based Buffer Overflow (CWE-122)

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction...

CVE-2026-48440

CVE-2026-48440 affects Adobe ColdFusion due to a Heap-based Buffer Overflow . The issue could allow arbitrary code execution in the context of the current user . Exploitation depends on conditions beyond the attacker’s control and does not require user interaction. Current documents do not specif...

CVE-2026-48440 ColdFusion | Heap-based Buffer Overflow (CWE-122)

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction...

PT-2026-70324

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

Amazon Linux 2 : oci-add-hooks, --advisory ALAS2DOCKER-2026-122 (ALASDOCKER-2026-122)

The version of oci-add-hooks installed on the remote host is prior to 0-0.10.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-122 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a...

Astra Linux – Vulnerability in Firefox

In some cases, JIT-compiled code might have dereferenced a wild pointer value. This could lead to a exploitable crash. This vulnerability affects Firefox versions earlier than 122...

Astra Linux – Vulnerability in Firefox and Thunderbird

A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

Astra Linux – Vulnerability in Firefox

The WebAudio OscillatorNode object was vulnerable to a stack buffer overflow. This could have led to a potentially exploitable crash. This vulnerability affects Firefox versions less than 122...

Astra Linux – Vulnerability in Firefox and Thunderbird

A Linux user who opened the print preview dialog box could have caused the browser to crash. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 122. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects versions of Firefox prior to 123...

CVE-2025-61624

creationtimestamp| type| source ---|---|--- 2026-04-14 04:00:00+00:00| exploited| https://fortiguard.fortinet.com/psirt/FG-IR-26-122 2026-06-19 12:45:35+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cc9f5a22-991b-450e-a4f2-b67d62e07e1a...