CLEANSTART-2026-QG32153 Security fixes for CVE-2026-42504 applied in versions: 9.3.4-r3

Security vulnerability affects the elastic-beats package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-62944

Name of the Vulnerable Software and Affected Versions Oracle Communications BRM - Elastic Charging Engine versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 Description A flaw in the Diameter Gateway and SDK component allows a low privileged attacker with access to the infrastructure wher...

CVE-2026-61053: Improper Privilege Management

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications component: Diameter Gateway and SDK. Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacke...

CLEANSTART-2026-BM12601 Security fixes for CVE-2025-54410, CVE-2026-27145, CVE-2026-32952, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-40179, CVE-2026-42499, CVE-2026-42501, CVE-2026-42504, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-4vq8-7jfc-9cvp, ghsa-p77j-4mvh-x3m3, ghsa-pjcq-xvwq-hhpj, ghsa-vffh-x6r8-xx99, ghsa-wg65-39gg-5wfj applied in versions: 8.18.1-r0, 8.19.15-r0, 8.19.15-r2, 8.19.15-r3, 8.19.15-r5, 8.19.15-r6, 9.1.10-r0

Multiple security vulnerabilities affect the elastic-beats package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TF69182 Security fixes for CVE-2026-42504 applied in versions: 9.3.4-r3

Security vulnerability affects the elastic-beats package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-63670

Multiple security vulnerabilities affect the elastic-beats package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63745

Security vulnerability affects the elastic-beats package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-KR89831 Security fixes for CVE-2026-42504 applied in versions: 8.19.14-r2

Security vulnerability affects the elastic-beats package. This issue is resolved in later releases. See references for vulnerability details...

PYSEC-2026-881 OpenStack Nova Multiple directory traversal vulnerabilities

Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted 1 tarball or 2 manifest...

PYSEC-2026-652 OpenStack Keystone allows context-dependent attackers to bypass access restrictions

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the 1 user, 2 tenant, or 3 domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions...

PYSEC-2026-691 OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor

OpenStack Nova before 2012.1 allows someone with access to an EC2ACCESSKEY equivalent to a username to obtain the EC2SECRETKEY equivalent to a password. Exposing the EC2ACCESSKEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2SECRETKEY. A...

CVE-2026-56152

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view...

CVE-2026-56152

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

CVE-2026-56152 Incorrect Authorization in Kibana Leading to Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view...

EUVD-2026-41087

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

CVE-2026-56152

Summary: CVE-2026-56152 concerns Elastic Defend. Affected component is the Elastic Defend response actions where an authorization check failure allowed a low-privileged authenticated user to access response action data they should not view (CWE-863, CAPEC-1). Impact details (as described): The vu...

CVE-2026-56152 Incorrect Authorization in Kibana Leading to Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view...

Kibana 7.17.15, 8.11.1 Security Update (ESA-2026-53)

Improper Output Neutralization for Logs in Kibana Leading to Log Injection Improper Output Neutralization for Logs CWE-117 in Kibana can lead to log injection via Log Injection-Tampering-Forging CAPEC-93. An attacker can supply specially crafted input that is written to log files without proper...

Elastic Defend 8.19.13, 9.2.7, 9.3.2 Security Update (ESA-2026-46)

Incorrect Authorization in Elastic Defend Leading to Information Disclosure Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged...

Elasticsearch 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-43)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a special...