CVE-2026-13365

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-13365 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-13365

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

EUVD-2026-58360

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-72665

CVE-2026-72665 involves Missing Authorization (CWE-862) in Kibana, enabling a user who can author/evaluate Elastic Security detection rules to trigger host response actions (Osquery and Elastic Defend) on enrolled agents without proper privileges. The Elastic advisory notes affected Kibana/Elasti...

EUVD-2026-58266

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

CVE-2026-72665

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

CVE-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

CVE-2026-72664

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

CVE-2026-72664 Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

CVE-2026-72664

Kibana contains a Missing Authorization (CWE-862) vulnerability (CVE-2026-72664) that can allow unauthorized execution of Elastic Defend response actions on managed hosts when a user with only detection-rule privileges can link automated endpoint actions to a rule. The underlying issue is imprope...

CVE-2026-57897

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-24059

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

EUVD-2026-58128

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-58416

CVE-2026-58416 (Gitea) describes a read-access leak in the Fork-PR Actions path: when a private repo B lists A as a collaborative owner, GetActionsUserRepoPermission on the collaborative-owner branch returns code-read permissions even if the fork PR is involved, enabling an attacker to clone a th...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

EUVD-2026-58149

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897

CVE-2026-57897 describes a Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs in Gitea. Connected sources confirm the issue affects Gitea’s org-level Actions Run/Job API surface, enabling information disclosure across repositories. The vulnerability’s exact root cause is not exh...