EUVD-2026-46403

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

EUVD-2026-46396

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...

EUVD-2026-46385

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

CVE-2026-65054

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API...

CVE-2026-56147

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

CVE-2026-56146

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...

CVE-2026-49092

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

CVE-2026-56147

CVE-2026-56147 describes an Authorization Bypass in Kibana where a low-privileged authenticated user can bypass file access controls due to a mismatch between access checks and resource retrieval. The vulnerability enables unauthorized retrieval, modification, or deletion of case attachments (inc...

Kibana 8.19.18, 9.3.7, 9.4.3 Security Update (ESA-2026-59)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity...

CVE-2026-56146

CVE-2026-56146 : In Kibana, an improper access control (CWE-284) in the Entity Analytics Watchlist configuration allows a low-privileged, authenticated user with read-only Security Solution access to perform write operations on watchlist data that should require elevated privileges, and potential...

CVE-2026-56146 Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...

CVE-2026-49092

CVE-2026-49092 affects Kibana with an Unintended Proxy or Intermediary (CWE-441) that can lead to unauthorized information exposure when processing data from sources not authorized for the user. Connected documents specify the vulnerability stems from functionality not properly constrained by ACL...

CVE-2026-49092 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

Kibana 9.4.3 Security Update (ESA-2026-54)

Unintended Proxy or Intermediary 'Confused Deputy' in Kibana Leading to Unauthorized Information Exposure Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under...

CVE-2026-47418

Vulnerability: PraisonAI Platform is affected by an insecure direct object reference (IDOR) in project endpoints. The API gates access using require_workspace_member(workspace_id) but does not enforce workspace-scoped lookups for project_id. As a result, a member of one workspace (W1) can read, m...

CVE-2026-47405

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged...

CVE-2026-47405 PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged...

CVE-2026-28321

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations...

CVE-2026-28309

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments...

CVE-2026-15789

The CVE-2026-15789 entry describes a vulnerability in the BuildKit daemon where a malicious client can bypass destination directory validation during local sources uploads, allowing files to escape the BuildKit-controlled state directory. Exploitation requires the attacker to have valid permissio...