CVE-2026-31215

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /indexname/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied pathorurl parameter...

Missing Authorization

Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Missing Authorization in the folderdelete and filedelete processes. An attacker can permanently delete all documents and folders by...

Elastic: Over-Privileged API Credentials for Elastic Agent

@captaingeech found that the permissions grated to the Elastic Agent in a Fleet environment grant the ability to delete documents from sensitive security indices...