1252831 matches found
CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...
CVE-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...
CVE-2026-78595
CVE-2026-78595 is a Missing Authorization (CWE-862) vulnerability in the Kibana Fleet feature that enables cross-space information disclosure. An authenticated user with only read-level Fleet agent privileges in one Kibana space can enumerate agent metadata and access diagnostic content belonging...
CVE-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...
EUVD-2026-70659
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...
CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...
EUVD-2026-70654
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...
CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...
CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...
Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)
Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated...
Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)
Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticate...
envsec v1.0.0-rc.2
envsec Secure environment secrets management using native OS credential stores. Demo Features Store secrets in your OS native credential store not plain text files Cross-platform: macOS, Linux, Windows Organize secrets by context e.g. myapp.dev, stripe-api.prod, work.staging Track secret metadata...
CVE-2026-85302
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...
CVE-2026-85303
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...
CVE-2026-84812
Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...
CVE-2026-84848
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84774
Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.11 versions...
CVE-2026-84773
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...