380511 matches found
CVE-2026-105240 Apache log4net: NUL character truncates OutputDebugStringAppender records
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was...
CVE-2026-105239 Apache log4net: NUL character truncates EventLogAppender records
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently...
EUVD-2026-93863
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently...
CVE-2026-105239 Apache log4net: NUL character truncates EventLogAppender records
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently...
CVE-2026-101157
A stored cross-site scripting (XSS) vulnerability exists that may allow an unauthenticated attacker with adjacent-network access to inject malicious content. This content executes when an authenticated user views the affected content, potentially allowing the attacker to compromise the victim's a...
CVE-2026-101156
A stored cross-site scripting (XSS) vulnerability exists in the affected system, potentially allowing an authenticated, high-privilege administrator to inject malicious content into a configuration. This content can execute in the browser of another authenticated user when they view or compare th...
CVE-2026-101156 Security Advisory 0192
A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...
EUVD-2026-93954
An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...
CVE-2026-102157 Security Advisory 0190
An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...
CVE-2026-102157
An insecure direct object reference (IDOR) vulnerability exists in the CloudVision CUE file-serving interface . This flaw may allow an authenticated network user to access another user's transient data under specific attack conditions. No specific exploit details or remediation steps are provided...
CVE-2026-102157 Security Advisory 0190
An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...
CVE-2026-101153 Security Advisory 0188
On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...
CVE-2026-101153 Security Advisory 0188
On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...
EUVD-2026-93949
On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...
CVE-2026-101153
A path traversal vulnerability exists in CloudVision Portal (on-premises) and CloudVision Sensor . An authenticated user with high privileges could exploit this flaw to extract unintended data from the Sensor. The vulnerability is associated with CWE-22 (Improper Limitation of a Pathname to a Res...
EUVD-2026-93928
Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...
CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...
CVE-2026-102407
A vulnerability in Elasticsearch (CWE-863) allows an authenticated user with sufficient privileges over a single resource to modify a data stream to which they are not authorized. By using the Modify Data Streams API , an attacker can potentially inject data or affect searchability, though they c...
CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...
CVE-2026-102406
A CWE-639 Authorization Bypass in Kibana allows users with delegated Fleet package-management privileges to claim a data stream identifier already in use by another tenant. Because ownership is not verified before Fleet applies settings from an uploaded package, an attacker can redirect another t...