17194 matches found
CVE-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions
Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...
CVE-2026-63141
Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...
CVE-2026-63141
This CVE (CVE-2026-63141) concerns Missing Authorization (CWE-862) in Kibana’s Cloud Connect feature. An authenticated user can access and modify Cloud Connect configuration and service settings via insufficiently protected endpoints. Affected versions include Kibana 9.3.x (9.3.0–9.3.7) and 9.4.x...
CVE-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions
Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...
CVE-2026-63141
Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...
Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-65)
Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct...
Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...
CVE-2026-12139 Tanium addressed an information disclosure vulnerability in Connect.
Tanium addressed an information disclosure vulnerability in Connect...
CVE-2026-12139 Tanium addressed an information disclosure vulnerability in Connect.
Tanium addressed an information disclosure vulnerability in Connect...
CVE-2026-12139
Technical details for CVE-2026-12139 are not publicly available in the provided documents. Monitor for updates from Tanium or NVD for affected components, impact, and remediation.
CVE-2026-63871
A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability, a data-race, occurs because certain functions access socket-related data without proper synchronization. Specifically, isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync can read critical fields while...
SUSE CVE-2026-55639
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...
SUSE CVE-2026-63971
In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.
Summary postgresql-42.7.11.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-54291. Vulnerability Details CVEID:CVE-2026-54291 DESCRIPTION: pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently...
CVE-2026-16336
A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirecturi results in open redirect. It is possible to initiate t...
CVE-2026-16336 trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect
A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirecturi results in open redirect. It is possible to initiate t...
rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
A flaw was found in RabbitMQ. An authenticated MQTT Message Queuing Telemetry Transport user can bypass topic-level authorization by injecting regular expression operators. This occurs because the client ID, provided by the user in the MQTT CONNECT packet, is inserted into authorization regex...
PT-2026-62410
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can access and modify Cloud Connect configuration and service settings without the necessary feature privileges. This occurs due to missing authorization in product...
CVE-2026-63141: Missing Authorization
Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...