91 matches found
Elastic Agent 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-234)
Out-of-bounds Write in Elastic Agent Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder of Node.js, a dependency of Elastic Agent Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to cause a crash, disclose process memory, or...
Heartbeat 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-233)
Out-of-bounds Write in Heartbeat Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder of Node.js, a dependency of Heartbeat Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to cause a crash, disclose process memory, or potentially...
Elastic Agent “Complete Flavor” (Synthetics) 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-231)
Improper Certificate Validation in Elastic Agent Leading to Interception of TLS Connections Improper Certificate Validation CWE-295 in the Node.js runtime bundled with the Elastic Agent “Complete Flavor” Docker images that include Synthetics, a dependency of Elastic Agent “Complete Flavor”...
Heartbeat 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-230)
Improper Certificate Validation in Heartbeat Leading to Interception of TLS Connections Improper Certificate Validation CWE-295 in the Node.js runtime bundled with the Heartbeat Docker image, a dependency of Heartbeat Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attack...
BIT-KIBANA-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
BIT-ELK-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
PT-2026-105104
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
PT-2026-105099
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
Kibana 8.x < 8.19.22 / 9.0.x < 9.4.7 / 9.5.x < 9.5.3 Missing Authorization (ESA-2026-139)
The version of Kibana installed on the remote host is 8.x prior to 8.19.22, or 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-139 advisory. - Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of da...
CVE-2026-78582
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
CVE-2026-78582
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
CVE-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
EUVD-2026-87794
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
CVE-2026-78582
Kibana is vulnerable to a Missing Authorization (CWE-862) flaw that allows an authenticated user with Synthetics privileges in a single space to permanently delete Synthetics monitors shared in other spaces where they lack access. If a monitor is associated with a private location, the operation ...
CVE-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
CVE-2026-78582: Missing Authorization
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
PT-2026-99426
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization flaw allows an authenticated user with Synthetics privileges limited to a single Kibana space to permanently delete Synthetics monitors shared into spaces they are not...
Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-139)
Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to ...
Synthetics Plugin Bypass Security Restrictions
The vulnerability of the Synthetics plugin of the Kibana data visualization service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to bypass security restrictions while operating remotely...
