PT-2026-71762

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without...

PT-2026-71778

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with minimal privileges can cause a denial of service by submitting a specially crafted request to a validation capability of the Observability log analysis feature. This...

PT-2026-71765

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with read-only privileges to the alerting feature can cause a denial of service by submitting a specially crafted, malformed payload. This leads to excessive resource...

PT-2026-71787

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Kibana Fleet allows a user-supplied identifier for a Fleet Server host configuration to be accepted without rejecting relative traversal sequences. This identifier is stored and subsequently...

PT-2026-71775

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user with only detection rule authoring privileges for the Elastic Security solution to associate automated endpoint response actions with a detection rule. This...

PT-2026-71764

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass occurs when an authenticated user, authorized to read alerting rules in one Kibana space, can retrieve alerting rule execution telemetry from spaces they are not...

PT-2026-71783

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An incorrect authorization issue exists where functionality is not properly constrained by Access Control Lists ACLs. This allows an authenticated user with Synthetics write privileges in one...

PT-2026-71607

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.5 and later Description An OpenSSL QUIC server can allocate and queue new incoming channels without enforcing a limit when processing valid QUIC Initial packets for unknown destination connection IDs. The system uses the...

PT-2026-71750

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An uncaught exception in Kibana Cases allows for a denial of service through input data manipulation. This occurs because malformed link syntax stored in a case comment is not rejected or...

IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.9 DoS (7283485)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a DoS vulnerability as referenced in the 7283485 advisory. - IBM WebSphere Application Server Liberty is affected by a denial of service caused by insecure deserialization. A low-privileged,...

PT-2026-71784

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Kibana is subject to a denial of service issue due to the allocation of resources without limits or throttling. In the Kibana Playground for the RAG Retrieval-Augmented Generation feature, a...

PT-2026-71771

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An issue exists where a Kibana visualization feature does not correctly validate malformed payloads submitted by authenticated users with low-privileged access. This leads to unbounded memory...

PT-2026-71777

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass exists where a user can execute unauthorized queries against Elastic Agents assigned to a Kibana space they are not permitted to access. This occurs because functionali...

PT-2026-71769

Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...

PT-2026-71770

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Cross-Site Request Forgery CSRF allows a user with permissions to create visualizations to save a specially crafted Vega visualization. When another user opens this visualization, it triggers...

IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.9 (7283488)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 7283488 advisory. - IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled...

PT-2026-71460

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...

PT-2026-71753

Name of the Vulnerable Software and Affected Versions Kibana Fleet affected versions not specified Description Improper privilege management in Kibana Fleet allows for privilege escalation. This occurs when an integration policy declares extra data streams for writing, which Fleet then adds to th...

PT-2026-71752

Name of the Vulnerable Software and Affected Versions Kibana Fleet affected versions not specified Description Incorrect Authorization in Kibana Fleet allows for privilege escalation through privilege abuse. The system restricts certain users to managing integration policies for a single specific...

PT-2026-71767

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...