CVE-2026-72683 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...

CVE-2026-72683

The CVE-2026-72683 issue affects Elasticsearch where an authenticated user able to call the simulate pipeline API can submit a request that creates a self-referential data structure. When processed by an internal component, the operation recurses without bound, causing a fatal error that terminat...

CVE-2026-59714

CVE-2026-59714 describes a cross-channel message overwrite vulnerability in Open WebUI exposed by the chat-completions path. From v0.9.5 to before v0.10.0, an authenticated user could overwrite a message in a channel they do not belong to by using a channel: chat_id with a caller-supplied message...

EUVD-2026-58246

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-49089

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

CVE-2026-49089

CVE-2026-49089 reflects an issue in Kibana where a query expression accepted by a connector could be processed without size limits, allowing an authenticated read-only user to trigger a DoS by an oversized expression. The Elastic advisories describe the root cause as unbounded evaluation time for...

CVE-2026-71287

A flaw was found in Cacti. An authenticated user, regardless of their privilege level, can exploit a vulnerability where user-supplied input for sorting database columns is not properly sanitized. This allows for the injection of malicious SQL commands, leading to time-based blind SQL injection...

CVE-2026-19744

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744

CVE-2026-19744 details a stored Cross-site Scripting (XSS) vulnerability in the Markdown renderer of Pentestify (MaAlfer) prior to version 2.3.2. The issue arises when a Markdown link URL contains a double quote, which closes the anchor href and allows arbitrary JavaScript execution in the applic...

CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-73575

CVE-2026-73575 affects Zimbra Collaboration (ZCS) pre-10.1.17. A CSRF vulnerability exists in the Exchange Web Services (EWS) endpoint caused by insufficient validation of request content types. An attacker could induce an authenticated user to submit a crafted request, potentially allowing unaut...

CVE-2026-73575

In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...

CVE-2026-14256

CVE-2026-14256 involves a potential out-of-bounds write in the ELAN TrackPoint driver. Under certain conditions, a local authenticated user could cause a system crash. The available data identifies the affected component (ELAN TrackPoint driver) and the impact (availability loss via crash) but do...

CVE-2026-63423

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

EUVD-2026-58060

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-63423

Technical details about CVE-2026-63423 are not publicly available in the provided documents. Monitor for updates from Lenovo and NVD; no affected products, vectors, or mitigations can be confirmed from the supplied sources.

CVE-2026-63424

CVE-2026-63424 concerns Lenovo Dock Manager. A locally authenticated user can escalate privileges due to an improperly protected key. The CVSS data indicate a local attack with LOW privileges required and no user interaction, with high impact on integrity and availability, and low impact on confi...

CVE-2026-63425

During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges...