CVE-2026-72660 Uncaught Exception in Kibana Leading to Denial of Service

Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data...

CVE-2026-72660

Kibana is affected by CVE-2026-72660 due to an Uncaught Exception (CWE-248) from Improper Input Validation (CWE-20) that can cause a Denial of Service (CAPEC-153). An authenticated Kibana account with at least read access and the ability to write to an Elasticsearch index can trigger an internal ...

CVE-2026-72660

Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data...

CVE-2026-72659

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly...

CVE-2026-72659 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly...

EUVD-2026-58251

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the...

CVE-2026-72687 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the...

CVE-2026-72687 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the...

CVE-2026-72686 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation...

CVE-2026-72685 Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

CVE-2026-72685

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

CVE-2026-72685

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

CVE-2026-72685 Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

Frappe GDPR Personal Data Download Request ownership error leads to IDOR, allowing download of other users' PII

Frappe GDPR Personal Data Download Request Ownership Error Leads to IDOR, Allowing Download of Other Users' PII Vulnerability Overview When generating a user's personal data export file, the Personal Data Download Request feature that Frappe Framework provides for GDPR compliance failed to...

PhotoPrism Vision API can read server-local files

PhotoPrism Vision API can read server-local files Vulnerability Overview PhotoPrism's computer vision features caption, labels, nsfw, face assemble image references into outbound requests to the configured vision model through a set of request builders. Image references come from two sources: loc...

CVE-2026-19292

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...

EUVD-2026-57927

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...

Johnson Controls Metasys

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and...

PT-2026-71772

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Improper input validation allows an authenticated user with low-privileged access to trigger an internal error condition by providing specially crafted data. This results in an uncaught...

PT-2026-71767

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Improperly Controlled Modification of Dynamically-Determined Object Attributes in the case management functionality of Elastic Security in Kibana allows an authenticated user without case...