Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92)

Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Description: Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

PT-2026-71847

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management...

CVE-2026-17438: Improper Privilege Management

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management...

CVE-2026-72675: Missing Authorization

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

CVE-2026-16480

IBM Db2 11.5.0–11.5.9 and 12.1.0–12.1.5 contain a CWE-602 authorization bypass allowing low-privileged users to modify database catalog data. NVD rates it HIGH (CVSS 7.1); IBM rates it MEDIUM (4.3). Fixes are available via IBM Fix Central security updates. No workarounds are provided. No active e...

CVE-2026-73298

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-17222

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command...

CVE-2026-17222

IBM i CVE-2026-17222 affects IBM i 7.6, 7.5, 7.4, and 7.3 (5770-SS1) where an authenticated remote attacker could modify data in certain SQL tables due to improper neutralization of special elements in an SQL command. The IBM security bulletin lists related SQL vulnerabilities and provides fixes ...

CVE-2026-17222 IBM i is Affected By Multiple Vulnerabilities in SQL

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command...

EUVD-2026-57372

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command...

CVE-2026-59652

A flaw was found in Bouncy Castle for Java, specifically within the legacy jdk1.4 LDAPStoreHelper. This vulnerability allows for LDAP filter injection, where an attacker could provide specially crafted input. This could lead to unauthorized information disclosure or modification of data from the...

CVE-2026-17346

A flaw was found in pgAdmin 4. A low-privileged user can exploit a SQL injection vulnerability when object names, such as schema, table, publication, or subscription names, containing special characters are not properly escaped. When any user, including those with higher privileges, views the...

CVE-2026-17222: Improper Neutralization of Special Elements used in an SQL Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command...

The vulnerability of the Azure Active Directory identity management and protection platform, related to modifications of expected data, allows attackers to escalate their privileges.

The vulnerability of the Azure Active Directory identity management and protection platform is related to modifications of assumed data. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

PT-2026-71189

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can modify data in specific SQL tables. This is caused by improper neutralization of special elements used in an SQL command, a condition known as SQL injection, where...

Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-72555 Peppermint Lab Peppermint - Broken Access Control

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.rolesactive flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass...