CVE-2026-44879

CVE-2026-44879 affects HPE Aruba EdgeConnect SD-WAN ECOS gateways with an authenticated, highly privileged attacker able to perform command injection via the CLI. Reported impact is arbitrary command execution on the underlying OS. Affected ECOS versions include 9.4.x.x (≤9.4.6.x), 9.5.x.x (≤9.5....

CVE-2026-44878 Authenticated Path Traversal allows Unauthorized Access in Web Interface

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

GHSA-H2X6-G7Q6-344V Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone...

CVE-2026-63139

CVE-2026-63139 describes an Uncontrolled Resource Consumption (CWE-400) in Kibana, specifically targeting the Canvas functionality. An authenticated low-privilege user can trigger a specially crafted request that causes excessive allocation, leading to the Kibana server process termination and a ...

CVE-2026-63139 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causin...

CVE-2026-63139 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causin...

CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

CVE-2026-46556

The CVE describes a Server-Side Request Forgery (SSRF) in FlaskBB prior to 2.2.1, where get_image_info(url) passes the supplied URL directly to requests.get without validating scheme/host/IP. This allows any authenticated user to cause the server to access internal endpoints and cloud metadata se...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-63)

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in...

CVE-2026-64821 djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821

The issue CVE-2026-64821 affects djangoSIGE up to version 1.10. The vulnerability arises in order-cancellation logic (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) implemented in HTTP GET handlers, allowing unauthenticated attackers to...

CVE-2026-65054 MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API...

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea's Debian package registry parser contains an unbounded decompression vulnerability in ParseControlFile. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the entire uncompressed stream into a strings.Builder via a TeeReader, with no limit on how much...

GHSA-6HM7-3PWJ-22RM Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea's Debian package registry parser contains an unbounded decompression vulnerability in ParseControlFile. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the entire uncompressed stream into a strings.Builder via a TeeReader, with no limit on how much...

CVE-2026-56145

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive...

CVE-2026-42397

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-63358 FileGator privilege escalation

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...

CVE-2026-63358 FileGator privilege escalation

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...

CVE-2026-63358

Summary of CVE-2026-63358 (FileGator privilege escalation) The affected software is FileGator. The vulnerability arises in the /chmoditems API endpoint, which accepts arbitrary Unix permission values and passes them directly to PHP’s native chmod() via octdec() without validation. This enables an...

CVE-2026-56146 Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...