CVE-2026-6470

The CVE-2026-6470 issue affects PostgreSQL prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24. It arises from missing authorization in DDL commands, allowing an object creator to trigger denial of service against ALTER and DROP by creating a dependency on a type. The underlying root cause is ...

CVE-2026-73616

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...

CVE-2026-73607

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...

CVE-2026-73608

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

CVE-2026-73616

Technical details (affected products, vulnerable components, root cause, remediation) are not publicly provided in the supplied documents. Monitor for updates from OpenRemote advisories and CVE listings for concrete technical specifics and fixes.

CVE-2026-73612 File Browser before v2.63.22 Authorization Bypass via Recursive Operations

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

CVE-2026-73612

CVE-2026-73612 affects File Browser prior to v2.63.22. The flaw is failing to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls by acting on an allowed parent directory. This enables copyin...

CVE-2026-73612 File Browser before v2.63.22 Authorization Bypass via Recursive Operations

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

EUVD-2026-57812

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

CVE-2026-73608 SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

CVE-2026-73608

SiYuan has a missing-authorization vulnerability in the development branch for the /api/av/getAttributeViewSearchTarget endpoint. The route is protected only by CheckAuth and performs no further authorization checks, allowing anonymous readers to query with a database identifier and a keyword to ...

EUVD-2026-57811

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-124)

Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. ...

Kibana 9.4.5 Security Update (ESA-2026-97)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting...

Kibana 9.4.5 Security Update (ESA-2026-89)

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead o...

Kibana 9.4.5 Security Update (ESA-2026-82)

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...

Kibana 9.4.4 Security Update (ESA-2026-83)

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly...

Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-95)

Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88)

Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges...