343222 matches found
Kibana 9.4.4 Security Update (ESA-2026-73)
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. Affected Versions: 9.4.x: All versions from 9.4.0 up to and...
CVE-2026-63261 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...
PT-2026-63265
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated attacker with low-privilege access can cause a denial of service by sending a specially crafted, oversized request payload. This triggers uncontrolled resource consumption...
PT-2026-63266
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Uncontrolled Resource Consumption in Kibana can lead to a denial of service through excessive allocation. A low-privileged authenticated user can send a specially crafted request to a machine...
PT-2026-61822
Missing Cryptographic Step CWE-325 vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with...
@agentspec/claude-plugin (>=0.1.0, <=0.2.0), @agentspec/sidecar (0.1.0) +86 more potentially affected by CVE-2021-21322 +1 more via @fastify/http-proxy (>=9.4.0, <=11.5.0)
@fastify/http-proxy NPM version =9.4.0, =0.1.0, =1.0.19, =2.1.22, =0.1.1, =0.1.0, =0.0.4, =0.0.4, =6.0.0-canary.2685, =0.0.4, =0.0.4, =4.0.0-canary.13864, =4.0.0-canary.13864, =0.0.4, =9.0.0-canary.1784 and more Source cves: CVE-2021-21322, CVE-2026-15631 Source advisory:...
Rocket.Chat: Stored HTML Injection (CWE-79) via Livechat Visitor Name
Vulnerability description not provided...
EUVD-2026-45140
Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...
Insertion of Sensitive Information Into Sent Data
Overview @keycloak/keycloak-admin-ui is a This project is the next generation of the Keycloak Admin UI. It is written with React and PatternFly 4 and uses Vite. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through...
CVE-2026-20158
Technical details (affected products, versions, root cause, and exploit information) are not publicly available in the provided documents. Monitor for updates.
CVE-2026-20153
Technical details (affected products/versions, root cause, impact, fixes) are not provided in the supplied documents. Monitor Cisco Security Advisory and CVE entry for updates.
Cisco RoomOS Security Hardening Release: July 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. These...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via XAML parsing in Windows Presentation Foundation WPF. An attacker can execute arbitrary code by supplying specially crafted XAML input that is processed by a vulnerable WPF application. Successful...
CVE-2026-47470
NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack. A successful exploit of this vulnerability might lead to denial of service...
CVE-2026-48329 ColdFusion | Insufficient Session Expiration (CWE-613)
ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...
EUVD-2026-44468
NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack. A successful exploit of this vulnerability might lead to denial of service...
CVE-2026-48369
Premiere Pro is affected by an out-of-bounds write (CWE-787 ) vulnerability that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. The connected documents do not provide details on affected versi...
PT-2026-58055
An Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability CWE-113 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all...
