CVE-2026-88890: Improper Neutralization of Special Elements used in an SQL Command

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...

irflow-timeline v1.0.13

IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...

documentsreader (1.1.5), midastrader (>=1.0.1, <=1.0.23) +1 more potentially affected by CVE-2026-55073 via weasyprint (62.1.0)

weasyprint PYPI version 62.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - documentsreader 1.1.5 - midastrader =1.0.1, =1.0.1, =1.0.7 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

BIT-KIBANA-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

BIT-ELK-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

Malicious Package

Overview @umschool/analytics is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of t...

Kibana 9.1.x < 9.4.6 / 9.5.x < 9.5.2 Incorrect Authorization (ESA-2026-130)

The version of Kibana installed on the remote host is 9.1.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-130 advisory. - Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via...

Kibana 9.4.x < 9.4.6 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-122)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.6, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-122 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing...

MAL-2026-16051 Malicious code in @umschool/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...

Malicious code in @umschool/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...

CVE-2026-86810

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810

Open-Web-Analytics (up to 1.9.1) contains an improper authentication vulnerability in the checkCapabilityAndAuthenticateUser function within Core/Controller.php (Controller component). A remote, unauthenticated attacker can manipulate this function to bypass authentication checks. The CVSS 3.1 sc...

CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

EUVD-2026-74161

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810: Improper Authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

PT-2026-88457

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

BIT-KIBANA-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

BIT-ELK-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...