CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-62547

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...

CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63143

Technical details (affected products, components, versions, exploitability) are not publicly available in the provided documents; monitor for updates.

CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-67)

Missing Authorization in Kibana Leading to Unauthorized Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space...

EUVD-2026-46403

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

GHSA-7WVC-RVP7-W99X Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In...

CVE-2026-64615

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-56147 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

CVE-2026-56147

CVE-2026-56147 describes an Authorization Bypass in Kibana where a low-privileged authenticated user can bypass file access controls due to a mismatch between access checks and resource retrieval. The vulnerability enables unauthorized retrieval, modification, or deletion of case attachments (inc...

CVE-2026-65067

CVE-2026-65067 affects Data::Intern::Shared prior to 0.02 for Perl. The code creates a world-readable mmap backing file via open(path, O_RDWR|O_CREAT, 0666) with mode 0666, which becomes 0644 under the default umask. Absence of O_NOFOLLOW means a symlink at the path is followed, and absence of O_...

CVE-2026-47413

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" an...

CVE-2026-47411

PraisonAI Platform contains an authorization bypass in PATCH /workspaces/{workspace_id}: endpoints guarded by require_workspace_member (default min_role=member) allow any workspace member to rewrite workspace name, description, and the free‑form settings JSON. This can enable configuration inject...

CVE-2026-50274

A flaw was found in Datadog dd-trace-go, a Go client library. A remote, unauthenticated attacker can exploit this vulnerability by sending a request with a specially crafted baggage header containing an arbitrarily large number of key-value pairs or a very large single value. This can lead to...

Vulnerabilities handled in IBM Langflow OSS

IBM has addressed several vulnerabilities in the IBM Langflow OSS versions from 1.0.0 to 1.10.0. The vulnerabilities in IBM Langflow OSS include: - Execution of arbitrary file modifications by authorized users through specially crafted Content-Disposition headers. - Server-side request forgery SS...

PT-2026-63292

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The REST API exposes organization membership of public members within a private organization. An unauthorized user can determine if a specific user is a member of a private organization by...

PT-2026-63284

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted RFC 4716 SSH2 public key to the SSH key ingestion endpoint. The issue stems from a normalization function...

PT-2026-63261

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user with limited feature privileges to access workflow execution outputs within their Kibana space. This occurs because the documented API does not properly...