389220 matches found
PT-2026-107156
Name of the Vulnerable Software and Affected Versions Kibana versions 8.14.0 through 8.19.21 Kibana versions 9.0.0 through 9.4.6 Kibana versions 9.5.0 through 9.5.3 Description An authorization bypass exists in the Fleet package installation process where a user with delegated package-management...
PT-2026-107157
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Incorrect authorization allows an authenticated user with privileges over a single resource to modify a data stream they are not authorized to access. This is achieved by using the Modi...
PT-2026-107244
Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions 0.11.12 through 1.14.6 @backstage/plugin-techdocs-node versions 1.15.0 through 1.15.4 Description Improper validation of mkdocs plugin configuration in techdocs allows an authenticated attacker with...
CVE-2026-106585: Improper Handling of Highly Compressed Data (Data Amplification)
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...
Linux Distros Unpatched Vulnerability : CVE-2026-98298
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the...
Kibana 9.0.x < 9.4.7 / 9.5.x < 9.5.4 Incorrect Authorization (ESA-2026-187)
The version of Kibana installed on the remote host is 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-187 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data...
Linux Distros Unpatched Vulnerability : CVE-2026-98304
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen...
PT-2026-107138
A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...
PT-2026-106471
Unauthenticated Sensitive Data Exposure in Norvis Backup = 1.1.0 versions...
CVE-2026-41559: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...
CVE-2026-41561: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Museder RestoreOne = 2.7.276 versions...
CVE-2026-41562: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Norvis Backup = 1.1.0 versions...
CVE-2026-42413: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate = 1.3.2 versions...
PT-2026-106468
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...
PT-2026-106472
Unauthenticated Sensitive Data Exposure in Snapshotify All-in-One Backup & Restore & Migrate = 1.3.2 versions...
PT-2026-107295
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.5.1 Backstage versions prior to 3.6.2 Backstage versions prior to 3.7.2 Backstage versions prior to 3.8.2 Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains improp...
WS-2026-0154
@payloadcms/plugin-mcp 0.0.1-alpha.0, 3.61.0 through 3.87.1 and 4.0.0-canary.0 through 4.0.0-canary.30: the MCP login tool let the caller set showHiddenFields and overrideAccess on 3.x, so login responses could return hidden fields such as credential data GHSA-jjm7-864w-gg8q...
CVE-2026-101153: Improper Limitation of a Pathname to a Restricted Directory
On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...