10112 matches found
CVE-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...
CVE-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...
CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...
CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...
EUVD-2026-69565
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...
Kibana 9.4.6, 9.5.2 Security Update (ESA-2026-130)
Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only...
Malicious Package
Overview @testrelic/appium-analytics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
PT-2026-84385
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Incorrect authorization in Kibana Entity Analytics allows an authenticated user with only read-level Security feature access and no Elasticsearch privileges to stop the recurring Privilege...
CVE-2026-72633: Incorrect Authorization
Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...
CVE-2026-72641: Incorrect Authorization
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...
PT-2026-84386
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...
MAL-2026-15647 Malicious code in @testrelic/appium-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b67d6f23451a756c154b86142f91615f5c08c415166c1f66216c8c83d74cbeb The package registers scripts/postinstall.cjs as an npm postinstall hook. Alongside a benign-looking config-writer, the script contains an obfuscatio...
Malicious code in @testrelic/appium-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b67d6f23451a756c154b86142f91615f5c08c415166c1f66216c8c83d74cbeb The package registers scripts/postinstall.cjs as an npm postinstall hook. Alongside a benign-looking config-writer, the script contains an obfuscatio...
ai.tock:bot-test (23.9.2), ai.tock:bot-test-base (23.9.2) +505 more potentially affected by CVE-2026-82463 via org.pac4j:pac4j-core (>=6.0.0-rc1, <=6.5.5)
org.pac4j:pac4j-core MAVEN version =6.0.0-rc1, =6.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - ai.tock:bot-test 23.9.2 - ai.tock:bot-test-base 23.9.2 - ai.tock:bot-toolkit 23.9.2 -...
Malicious Package
Overview @testrelic/playwright-analytics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...
MAL-2026-15565 Malicious code in @testrelic/playwright-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...
Malicious code in @testrelic/playwright-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...
Malicious Package
Overview analytics-web-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2025-210809
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...