Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-98)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user wit...

CVE-2026-15217

creationtimestamp| type| source ---|---|--- 2026-08-13 10:21:54+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-20 2026-08-13 14:05:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msxssijrld2m 2026-08-13 20:15:15+00:00| seen|...

Cisco Identity Services Engine invokeScript Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the invokeScript method. The issue results from the lac...

PT-2026-71805

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path...

PT-2026-71426

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

PT-2026-71743

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A buffer overflow allows a remote authenticated attacker to execute arbitrary code. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is designed to hol...

DEBIAN-CVE-2026-73499

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-18150

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition...

CVE-2026-63300

An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...

CVE-2026-16907

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...

EUVD-2026-57374

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection...

EUVD-2026-57373

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in an SQL parameter...

EUVD-2026-57363

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation...

CVE-2026-16904 IBM i is Affected By improper privilege management in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

CVE-2026-18106

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input...

CVE-2026-18246 IBM i is Affected By security restrictions bypass in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

EUVD-2026-57349

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

CVE-2026-48554

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the comdata parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

EUVD-2026-57171

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...

CVE-2026-19550

FreeIPA contains an authorization flaw in the trust-fetch-domains command, which is gated by a read-only permission on the trust object rather than a trust-administration permission. An authenticated, non-privileged IPA user can exploit this to trigger a privileged Active Directory trust refresh ...