CVE-2026-4498

Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...

CVE-2026-4498

Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...

CVE-2025-54692

CVE-2025-54692 describes a missing authorization flaw in the WordPress plugin “Membership For WooCommerce” that allows access to functionality not properly constrained by ACLs. The vulnerability affects Membership For WooCommerce versions up to 2.9.0. The CVSS data indicates high impact (CVSS 3.1...