80894 matches found
CGA-XM52-M35J-46XG
Bulletin has no description...
CGA-3G96-C3PM-XPPP
Bulletin has no description...
CGA-M6PQ-MVW5-QJ2V
Bulletin has no description...
CGA-5CCG-5FC6-H242
Bulletin has no description...
CVE-2026-63262
Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...
PT-2026-63546
Summary An attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request...
PT-2026-63462
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fat...
PT-2026-63392
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname validdatstart, ...' and passes it straight to 'query dname...
CVE-2026-63143
Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...
CVE-2026-63262 Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...
CVE-2026-63262
CVE-2026-63262 affects Kibana with Missing Authorization (CWE-862), enabling unauthorized cross-space information disclosure via user-supplied input that bypasses space-level access control. CVSSv3.1 base score is 4.3 (Medium) with network attack vector and low privileges required. Details indica...
CVE-2026-63262
Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...
Kibana 9.4.4 Security Update (ESA-2026-73)
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. Affected Versions: 9.4.x: All versions from 9.4.0 up to and...
CVE-2026-63141
Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...
DEBIAN-CVE-2026-47254
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...
CVE-2026-43946
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue...
CVE-2026-63143
Technical details (affected products, components, versions, exploitability) are not publicly available in the provided documents; monitor for updates.
Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-67)
Missing Authorization in Kibana Leading to Unauthorized Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space...
GHSA-5QHF-9PHG-95M2 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while alloweduri?...