CVE-2026-63260

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this...

CVE-2026-63261 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

CVE-2026-63260

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this...

CVE-2026-63260

CVE-2026-63260 corresponds to an Uncontrolled Resource Consumption (CWE-400) vulnerability in Kibana. The connected sources describe an authenticated, low-privilege attacker triggering a denial of service by sending a specially crafted, oversized request payload that causes resource-intensive mem...

CVE-2026-63260 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this...

CVE-2026-8986

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-63142

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

CVE-2026-63142 Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-66)

Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the...

CVE-2026-63940

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM Secure Encrypted Virtualization SEV module. This vulnerability occurs because the system does not properly handle Port I/O requests with a length of zero. An attacker, potentially from a guest virtual machine, could exploit...

EUVD-2026-46427

Keep commit 91c75e0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a...

EUVD-2026-46409

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

EUVD-2026-46411

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causin...

CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65057

Keep commit 91c75e0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a...

GHSA-FW57-JGCH-PGF3 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...

CVE-2026-65057 Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck

Keep commit 91c75e0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a...

CVE-2026-65057 Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck

Keep commit 91c75e0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a...

CVE-2026-65057

The CVE-2026-65057 entry describes an SSRF in the Keep service (commit 91c75e0) where an unauthenticated attacker can force the backend to issue arbitrary HTTP requests by supplying a malicious host via the unprotected healthcheck endpoint. The mechanism appears to involve a crafted JSON payload ...