CVE-2026-46718 vulnerabilities

Vulnerabilities for packages: opensearch...

Malcolm v26.07.1

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard-fips, nextcloud-server, langfuse, librechat, gitlab-rails-ce, langfuse-fips, opensearch-dashboards, wazuh-dashboard, gitlab-rails-ce-fips...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, kibana, wazuh-dashboard-fips, nextcloud-server, langfuse, librechat, gitlab-rails-ce, langfuse-fips, opensearch-dashboards, wazuh-dashboard, gitlab-rails-ce-fips...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, kibana, wazuh-dashboard-fips, nextcloud-server, langfuse, librechat, langfuse-fips, opensearch-dashboards, wazuh-dashboard, gitlab-rails-ce-fips...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, langfuse...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, langfuse...

deadair v0.4.0

Open-source SIEM detection health. Find enabled detections that are blind because their telemetry is missing, stale, late, or schema-incompatible. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly Real scan of a...

EUVD-2026-46513

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: OpenSearch Dashboards. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-47026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: OpenSearch Dashboards. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CLEANSTART-2026-OI70918 Security fixes for CVE-2026-33870, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, ghsa-2c5c-chwr-9hqw, ghsa-38f8-5428-x5cv, ghsa-72hv-8253-57qq, ghsa-f6hv-jmp6-3vwv, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-pwqr-wmgm-9rr8 applied in versions: 2.19.5-r0, 3.6.0-r4

Multiple security vulnerabilities affect the opensearch package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KT42152 Security fixes for CVE-2026-12143, CVE-2026-44979, CVE-2026-45249, CVE-2026-46625, CVE-2026-53550, CVE-2026-53655, ghsa-cmwh-pvxp-8882 applied in versions: 3.6.0-r4

Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

Malcolm v26.07.0

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

CVE-2026-47026: URL Redirection to Untrusted Site

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: OpenSearch Dashboards. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

PT-2026-62011

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script fails to implement traversal protection when creating directory entries using the os.makedirsos.path.joindest, entry.pathname function. An attacker can upload a malicious...

PT-2026-62010

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script extracts uploaded archives without imposing limits on the number of entries, directory depth, total entries, or output size. An attacker can use a small malicious archive...

CVE-2026-56699

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Per Wazuh's Security Policy, vulnerabilities affecting only non-GA versions are not eligible for a CVE ID...

CVE-2026-56699

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Per Wazuh's Security Policy, vulnerabilities affecting only non-GA versions are not eligible for a CVE ID...

EUVD-2026-44630

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin...

CVE-2026-56699

The Wazuh Manager is vulnerable to NDJSON Injection in the inventory_sync() function within the cluster synchronization component. This occurs because the software fails to escape the DataValue.index field when constructing OpenSearch bulk requests. An attacker operating remotely can leverage thi...