CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

EUVD-2026-69569

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

CVE-2026-78608

CVE-2026-78608 is a Missing Authorization (CWE-862) vulnerability in Kibana , where an internal APM integration function lacked a proper authorization check. This allowed any authenticated Kibana user to read APM server credentials that should only be accessible to users with APM or Fleet adminis...

CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-144)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana us...

PT-2026-84398

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

CVE-2026-78608: Missing Authorization

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

Exploit for Improper Access Control in Oracle Application_Performance_Management

No d...

PT-2026-80948

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A command injection issue exists in the dray apm component. The flaw stems from insufficient validation of UDP message content following a START SPEED TEST request before the system...

GO-2025-4253 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, elastic-agent, cloudbeat-fips, cloudbeat, elastic-agent-fips...

GO-2026-4360 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, beats, cloudbeat-fips, cloudbeat...

GO-2025-4252 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, wazuh-manager-fips, beats-fips, elastic-agent, cloudbeat-fips, cloudbeat, wazuh-manager...

GO-2023-2413 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, elastic-agent, cloudbeat-fips, cloudbeat, elastic-agent-fips...

Malicious code in dolyame-ui-inputtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19ce8608ab1a5fcb21175b9bb64053362c941cf3ffefe754caf02c8000b44fb5 On require'dolyame-ui-inputtime', index.js loads./loader.js which fetches a platform-specific executable from hardcoded Cloudflare Workers hosts...

apm v11.2.0

APM A better local password manager for everyone. APM is a fast, zero-knowledge CLI password manager written in Go and Rust. It stores 25+ structured secret types in a single encrypted vault — from passwords and TOTP codes to SSH keys, medical records, photos, and binary files. Two binaries ship...

Malicious code in bnpl-blocks-atom-bnpl-review (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2251415239635fc707b724b732dcac0bb05e9b6714ad73bc5d6027d6b7247a05 On require of the package, index.js loads platform.js which fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-12817 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519214...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-59640 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512948...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-59648 Source advisory...