CVE-2026-62089

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

EUVD-2026-76194

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

CVE-2026-62089 WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

CVE-2026-62089

CVE-2026-62089 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Master Addons for Elementor by Pixar Labs, affecting versions from n/a through 3.2.2 . The flaw allows Privilege Abuse , enabling a low-privilege authenticated user to exploit the missing autho...

backup_dc_registry

Backup Operator 레지스트리 백업을 통한 도메인 손상 Backup Operator 권한을 남용하여 원격으로 SAM, SYSTEM, SECURITY 하이브를 덤프하는 간단한 POC입니다. 연구 크레딧: @filipdragovic @mpgn의 Windows PoC에서 포팅됨 사용법 이 개념 증명PoC은 impacket/examples/reg.py의 수정된 버전이며, 가장 최신 impacket 릴리스가 설치된 상태에서 작동합니다. 지원되는 모든 impacket 인증 메커니즘이 작동합니다. root@kitploit:...

litespeed-cpanel-cve-2026-54420-fix

CVE-2026-54420 완화 툴킷 CVE-2026-54420 에 대한 방어적 수정, 감사 및 검증 툴킷으로, CloudLinux / CageFS 를 사용하는 공유 호스팅 환경에서 LiteSpeed cPanel 플러그인 에 영향을 미칩니다. ⚠️ 보안 공지 이 저장소는 시스템 관리자, 호스팅 제공자, 방어적 보안 연구 만을 대상으로 합니다. 익스플로잇 코드, 공격 도구 또는 무기화된 개념 증명은 포함되어 있지 않습니다. CVE-2026-54420 정보 CVE-2026-54420는 LiteSpeed cPanel 플러그인 / WH...

BIT-KIBANA-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

Kibana 9.4.x < 9.4.5 Missing Authorization (ESA-2026-147)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-147 advisory. - Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization contro...

Kibana 7.x / 8.x < 8.19.21 / 9.0.x < 9.4.6 / 9.5.x < 9.5.2 Missing Authorization (ESA-2026-144)

The version of Kibana installed on the remote host is 7.14.0 through 7.17.29, or 8.x prior to 8.19.21, or 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-144 advisory. - Missing Authorization CWE-862 in Kibana can lead to...

CVE-2026-78595

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

CVE-2026-78596

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

CVE-2026-78596

Kibana (versions 8.19.2, 9.4.6, 9.5.3 ) is affected by a Missing Authorization flaw (CWE-862) in Entity Analytics migration operations . An authenticated user holding only Security read-level access in a single Kibana space can trigger these migration operations, which perform privileged writes a...

EUVD-2026-70660

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

EUVD-2026-70659

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

BIT-ELASTICSEARCH-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure

Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...

PT-2026-85214

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

PT-2026-85213

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

CVE-2026-78600

Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read...

CVE-2026-78601

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...

CVE-2026-78587

Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the activ...