PT-2026-63424

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and...

PT-2026-63461

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue in the server's Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and...

PT-2026-63473

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a server by sending a crafted Queryable Encryption find payload. This occurs because an unvalidated...

PT-2026-63481

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

PT-2026-63475

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

PT-2026-63480

An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...

PT-2026-63349

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

CVE-2026-63261

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

CVE-2026-63263

CVE-2026-63263 affects Elasticsearch’s ES|QL engine, where an authenticated user can submit a crafted query that triggers exponential CPU consumption during evaluation, causing uncontrolled resource exhaustion. The impact is denial of service as query worker resources become exhausted and ES|QL q...

CVE-2026-63261 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

CVE-2026-63261 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

CVE-2026-63261

CVE-2026-63261 describes an uncontrolled resource consumption (CWE-400) in Kibana, leading to denial of service via excessive memory allocation. The issue is triggered by a low-privileged authenticated user sending specially crafted requests to the Kibana machine learning feature, which can exhau...

CVE-2026-63261

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

CVE-2026-63260 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-71)

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by...

CVE-2026-63144

Summary (CVE-2026-63144): An uncontrolled recursion (CWE-674) in Elasticsearch’s query evaluation can cause a denial of service. A low-privilege authenticated user with read-level index access can submit a crafted search request that triggers unbounded recursive processing, leading to a fatal err...

CVE-2026-63144

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

CVE-2026-60175

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise...

CVE-2026-63142

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

GHSA-PRR9-9MP4-5GP2 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Summary PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization. Affected Versions = v1.26.4 latest and main branch Root Cause routers/api/v1/org/member.go — ListMembers: // Missing...