CVE-2026-56146 Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...

CVE-2026-49092 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

CVE-2026-49092

CVE-2026-49092 affects Kibana with an Unintended Proxy or Intermediary (CWE-441) that can lead to unauthorized information exposure when processing data from sources not authorized for the user. Connected documents specify the vulnerability stems from functionality not properly constrained by ACL...

Kibana 9.4.3 Security Update (ESA-2026-54)

Unintended Proxy or Intermediary 'Confused Deputy' in Kibana Leading to Unauthorized Information Exposure Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under...

CVE-2026-47418

Vulnerability: PraisonAI Platform is affected by an insecure direct object reference (IDOR) in project endpoints. The API gates access using require_workspace_member(workspace_id) but does not enforce workspace-scoped lookups for project_id. As a result, a member of one workspace (W1) can read, m...

CVE-2026-47405

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged...

CVE-2026-28321

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations...

CVE-2026-28309

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments...

CVE-2026-15789

The CVE-2026-15789 entry describes a vulnerability in the BuildKit daemon where a malicious client can bypass destination directory validation during local sources uploads, allowing files to escape the BuildKit-controlled state directory. Exploitation requires the attacker to have valid permissio...

acl: TOCTOU Symlink Traversal via getfacl/setfacl

A time-of-check to time-of-use TOCTOU race condition vulnerability was found in acl. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes...

acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

CVE-2026-28321

SolarWinds Serv-U is affected by a broken access control vulnerability (CVE-2026-28321) that could allow arbitrary file read and write, enabling privilege escalation and code execution as root. A domain administrator access is required, and impact is lower on Windows installations. The provided c...

CVE-2026-28321 SolarWinds Serv-U Broken Access Control Vulnerability

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations...

EUVD-2026-46299

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations...

CVE-2026-28309

CVE-2026-28309 affects SolarWinds Serv-U and is a broken access control vulnerability in which a domain administrator can create system administrator accounts. The impact is stated as higher for non-Windows environments and lower for Windows deployments. No exploitation details are provided in th...

EUVD-2026-46290

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments...

CVE-2026-6792

Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexCity: from 5.536.0 through 11052026...

SUSE CVE-2026-54369

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions aclgetfile, aclsetfile, aclextendedfile, and acldeletedeffile that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who contr...

CVE-2026-6792

Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexCity: from 5.536.0 through 11052026...

CVE-2026-6792

Technical details about CVE-2026-6792 are not publicly available in the provided documents. Monitor for updates from official advisories; the available sources only reiterate a Missing Authorization issue affecting FlexCity versions 5.536.0–11052026.