Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

MAL-2026-14018 Malicious code in bs58-77 (npm)

npm/bs58-77 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-77x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-77x as a runtime dependency declar...

PT-2026-71769

Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...

PT-2026-71767

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

EUVD-2026-56305

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-47299

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

Security Bulletin: QRadar App SDK for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar App SDK has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-25645 DESCRIPTION:...

CVE-2025-68926

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token "rustfs rpc" that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable...

CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token "rustfs rpc" that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable...

CVE-2025-68926

CVE-2025-68926 – RustFS hardcoded gRPC token authentication bypass . Affected RustFS versions prior to 1.0.0-alpha.78 expose a publicly visible hardcoded token, “rustfs rpc”, used for gRPC authentication on both client and server. The token is non-configurable and identical across deployments, en...

CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token "rustfs rpc" that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable...

[SECURITY] Fedora 43 Update: brotli-1.2.0-1.fc43

Brotli is a generic-purpose lossless compression algorithm that compresses da ta using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the be st currently available general-purpose compression methods. ...

Malicious code in alvira-77 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d55e6ecc47c30ab19f59b280c495c0cf459f7fca3fcc3cd7086d4ba7d2cc10a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153877 Malicious code in bitha-77 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c633cca96ab31064e79577677a85a343024b2cd391a8b09119191162cd885e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-77 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d50b4cbdc3fc2f3ddef9745dcc1b1935452db34328cfa924f0b31bed00672b50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aril-77 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb72ce415cfe23952cf69b25239fe0918cdbc1d23c11bec56aec8b2cdc8c418 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hariyono-77 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d4c3eda6b2a29c068aa8b9dceb4af1fc8cfe98fb3d3ddfd2d3b88bc0d6c288 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153730 Malicious code in billa-77 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a86426e39463ea719240dc1424bcca870783f96fb7c339373f8d7b3cdaa675d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kentung-77 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435c587df5676d0710608509372d0e6e2867eef1adc17e718ecd7cc16186d412 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in billa-77 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a86426e39463ea719240dc1424bcca870783f96fb7c339373f8d7b3cdaa675d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...