PT-2026-84638

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-84839: Missing Authentication for Critical Function

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

PT-2026-84668

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...

CVE-2026-84795: Improper Privilege Management

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...

F5 Networks BIG-IP : BIG-IP and BIG-IQ Configuration utility vulnerability (K000162521)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.4 / 17.5.1.8 / 21.0.0.3 / 21.1.0.1. It is, therefore, affected by a vulnerability as referenced in the K000162521 advisory. BIG-IP has a vulnerability where an authenticated user of any role may be able to create...

PT-2026-84761

Name of the Vulnerable Software and Affected Versions BIG-IP affected versions not specified BIG-IQ affected versions not specified Description An authenticated user with any role can escalate privileges by creating administrative user accounts. This is achieved through an undisclosed request sen...

PT-2026-84734

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

EUVD-2026-69639

A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious actor with administrative privileges to execute arbitrary code on the underlying operating system, when certain pre-conditions outside of th...

CVE-2026-78592

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

CVE-2026-76657

Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete...

CVE-2026-73748 Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further acce...

CVE-2026-73739

CVE-2026-73739 is an authenticated sensitive information disclosure in the API of HPE Networking Fabric Composer . Sensitive data that was expected to remain protected is exposed in cleartext format , allowing an attacker with administrative privileges and local access to retrieve it. The CVSS 3....

EUVD-2026-69466

A vulnerability exists in the API of HPE Networking Fabric Composer that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve sensitive information that was expected to remain protected...

EUVD-2026-69446

An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on...

CVE-2026-73711 Unauthenticated Privilege Escalation allows Administrative Access in HPE Networking Fabric Composer API

A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host...

EUVD-2026-69438

A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host...

EUVD-2026-69573

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-160)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path...