wazuh v5.0.0-beta5

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: ena: Fixed incorrect descriptor freeing behavior. ENA has two types of TX queues: - Queues that only process TX packets arriving from the network stack. - Queues that only process TX packets forwarded to them by XDPREDIRECT ...

Kibana 9.1.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-97 / ESA-2026-89)

The version of Kibana installed on the remote host is 9.1.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-89 and ESA-2026-97 advisories. - The Elastic Security capability that suggests existing field values while a user authors endpoint polic...

Kibana 8.9.x < 8.19.20 / 9.x < 9.4.5 Missing Authorization (ESA-2026-95)

The version of Kibana installed on the remote host is 8.9.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-95 advisory. - Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response...

Kibana 8.5.x < 8.19.20 / 9.x < 9.4.5 Missing Authorization (ESA-2026-96)

The version of Kibana installed on the remote host is 8.5.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-96 advisory. - Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend...

BIT-KIBANA-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

BIT-KIBANA-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

BIT-ELK-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

BIT-ELK-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

BIT-ELK-2026-72661 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint...

GO-2026-5932 vulnerabilities

Vulnerabilities for packages: peerdb-flow-fips, terrafmt-fips, elastic-agent, peerdb-flow, elastic-agent-fips, terrafmt...

GO-2026-5544 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, elastic-agent...

GO-2026-5343 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, elastic-agent...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: commercial-grafana, k3s, commercial-expanso-edge, datadog-agent, beats-fips, rke2-runtime, mattermost, kine, loki, frankenphp-8.5, containerd, elastic-agent-fips, grafana, fuse-overlayfs-snapshotter, mattermost-fips, datadog-agent-fips, frankenphp-8.3, elastic-agent,...

GO-2025-4252 vulnerabilities

Vulnerabilities for packages: beats-fips, cloudbeat-fips, apm-server-fips, elastic-agent, apm-server, cloudbeat...

GO-2026-4360 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, beats, apm-server-fips, apm-server, cloudbeat...

GO-2023-2413 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, apm-server-fips, elastic-agent, apm-server, elastic-agent-fips, cloudbeat...

GO-2025-4253 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, apm-server-fips, elastic-agent, apm-server, elastic-agent-fips, cloudbeat...

GO-2025-4173 vulnerabilities

Vulnerabilities for packages: agentbeat, beats-fips, zabbix-agent2, minio, elastic-agent-fips, falcosidekick, influxd, dapr-fips, bento, zabbix-agent2-fips, telegraf, falcosidekick-fips, minio-fips, elastic-agent, beats, agentbeat-fips, dapr...

CVE-2026-72665

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...