CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-135)

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-114)

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause...

CVE-2026-18931

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18630

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18931 Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18931 Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18931

This CVSS 9.1 (Critical) vulnerability affects TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software , versions V.4 through before V.16 . The root cause is hard-coded credentials embedded in the software, which allow an unauthenticated network attacker to retrieve embed...

CVE-2026-18630 SQL Injection in TMT Machine's Talassoft Industrial Management Software

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18630

CVE-2026-18630 is a SQL injection vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software , affecting versions from V.4 up to but not including V.16 . The root cause is improper neutralization of special elements used in an SQL command. The CVSS 3.1 score...

EUVD-2026-69284

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18630 SQL Injection in TMT Machine's Talassoft Industrial Management Software

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

EUVD-2026-69283

Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18780 CSRF in TMT Machine's Talassoft Industrial Management Software

Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18780

TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software contains a Cross-Site Request Forgery (CSRF) vulnerability affecting versions V.4 through before V.16 . The vulnerability allows an attacker to forge requests on behalf of an authenticated user, resulting in a High i...

CVE-2026-18780 CSRF in TMT Machine's Talassoft Industrial Management Software

Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

CVE-2026-18771

TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software is affected by a missing authentication for critical function vulnerability, enabling Authentication Bypass in versions V4 through before V.16 . The CNA (USOM, Turkey) assigned a CVSS 3.1 score of 7.5 (HIGH) with a v...

CVE-2026-18771 Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software

Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass. This issue affects Talassoft Industrial Management Software: from V4 before V.16...