PT-2026-63332

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

PT-2026-63472

Name of the Vulnerable Software and Affected Versions MongoDB mongos affected versions not specified Description An authenticated user with cursor termination privileges on one database may be incorrectly allowed to terminate active cursors on a different database. This issue occurs because an...

PT-2026-63351

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP...

PT-2026-63464

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with limited read privileges can access documents from collections they are not authorized to read. This occurs because of an inconsistency...

PT-2026-63446

Name of the Vulnerable Software and Affected Versions Cal.com OSS affected versions not specified Description An authorization flaw exists during the creation of webhooks. An authenticated user can perform an unvalidated injection of the teamId variable to create a webhook for any team. This allo...

Incorrect Authorization

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Incorrect Authorization in the CorsHandler. An attacker can gain unauthorized access to...

Missing Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via the workflow execution outputs. An attacker can access sensitive information by abusing limited feature...

CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63145

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-63259

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

CVE-2026-63262 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

CVE-2026-63262

CVE-2026-63262 affects Kibana with Missing Authorization (CWE-862), enabling unauthorized cross-space information disclosure via user-supplied input that bypasses space-level access control. CVSSv3.1 base score is 4.3 (Medium) with network attack vector and low privileges required. Details indica...

CVE-2026-63262 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

CVE-2026-63262

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

Kibana 9.4.4 Security Update (ESA-2026-73)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. Affected Versions: 9.4.x: All versions from 9.4.0 up to and...

CVE-2026-63259

CVE-2026-63259 affects Kibana and involves an Authorization Bypass via a user-controlled key, enabling potential information disclosure by referencing scheduled query result data in Kibana Spaces to which the requester lacks access. The CVSS 3.1 base score is 4.3 (Medium) with NETWORK attack vect...

CVE-2026-63259 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

CVE-2026-63259 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

CVE-2026-63259

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

Kibana 9.4.4 Security Update (ESA-2026-70)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the...