CVE-2026-79987 Low-privilege RCE through element-search eager loading

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

portabilis-ieducar-user-type-privilege-escalation

Portabilis i-Educar = 2.1.13 Escalada de Privilegios Mediante Petición Arbitraria al Endpoint de Cambio de Tipo de Usuario Prueba de concepto para la explotación de la vulnerabilidad descrita en CVE-2025-11554, que concierne a la posibilidad de una escalada de privilegios durante peticiones...

Kibana 8.x < 8.19.21 / 9.0.3 < 9.4.6 Missing Authorization (ESA-2026-155)

The version of Kibana installed on the remote host is 8.x prior to 8.19.21, or 9.0.3 prior to 9.4.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-155 advisory. - Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential...

EUVD-2026-72676

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

CVE-2026-85226

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

CVE-2026-78586 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, renderin...

CVE-2026-78597

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-73733

Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentication controls. Successful exploitation could allow an attacker to retain limited access to the affected system after that access should ha...

CVE-2026-73732

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to obtain sensitive information. Successful exploitation could allow an attacker to retrieve sensitive data which could be used to gain...

CVE-2026-73729

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to upstream AFC dependencies to view sensitive information. Successful exploitation could allow an attacker to access data beyond what is...

EUVD-2026-69471

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected...

CVE-2026-73742 Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the...

CVE-2026-73729 Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to upstream AFC dependencies to view sensitive information. Successful exploitation could allow an attacker to access data beyond what is...

CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-78597

Kibana 's Entity Store feature is affected by a Missing Authorization flaw (CWE-862) that allows an authenticated user with only low-privilege Security feature access to invoke an administrative operation, creating and persisting Elasticsearch API keys under the caller's identity while bypassing ...

EUVD-2026-68154

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

EUVD-2026-67823

StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

CVE-2026-82306 StarRocks Query Detail Endpoint Returns Every User's Query History

StarRocks through 4.0.13 contains an information disclosure vulnerability in the querydetail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

CVE-2026-61802 Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

EUVD-2026-65348

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...