Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)

Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated...

Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)

Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticate...

envsec v1.0.0-rc.2

envsec Secure environment secrets management using native OS credential stores. Demo Features Store secrets in your OS native credential store not plain text files Cross-platform: macOS, Linux, Windows Organize secrets by context e.g. myapp.dev, stripe-api.prod, work.staging Track secret metadata...

CVE-2026-85302

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

CVE-2026-85303

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...

CVE-2026-84812

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

CVE-2026-84848

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

CVE-2026-84774

Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.11 versions...

CVE-2026-84773

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2026-84763

Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...

CVE-2026-84765

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-81282

Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...

CVE-2026-81300

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

CVE-2026-81292

Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...

CVE-2026-81776

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

CVE-2026-81295

Unauthenticated Cross Site Scripting XSS in Under Construction = 5.82 versions...

CVE-2026-81773

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-81281

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-85302 WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

CVE-2026-85302 WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...