PYSEC-2026-881 OpenStack Nova Multiple directory traversal vulnerabilities

Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted 1 tarball or 2 manifest...

PYSEC-2026-652 OpenStack Keystone allows context-dependent attackers to bypass access restrictions

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the 1 user, 2 tenant, or 3 domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions...

PYSEC-2026-691 OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor

OpenStack Nova before 2012.1 allows someone with access to an EC2ACCESSKEY equivalent to a username to obtain the EC2SECRETKEY equivalent to a password. Exposing the EC2ACCESSKEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2SECRETKEY. A...

CVE-2026-56152

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

CVE-2026-56152

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

EUVD-2026-41087

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

CVE-2026-56152

Summary: CVE-2026-56152 concerns Elastic Defend. Affected component is the Elastic Defend response actions where an authorization check failure allowed a low-privileged authenticated user to access response action data they should not view (CWE-863, CAPEC-1). Impact details (as described): The vu...

CVE-2026-56152 Incorrect Authorization in Elastic Defend Leading to Information Disclosure

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

GHSA-PJV4-3C63-699F vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

CVE-2026-42602 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

PT-2026-54867

Name of the Vulnerable Software and Affected Versions Elastic Defend affected versions not specified Description Incorrect authorization allows a low-privileged authenticated user to access response action data they are not authorized to view. This occurs because functionality is not properly...

GHSA-HJ4R-2C9C-29H3 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat, cloudbeat-fips, elastic-agent-fips, elastic-agent, apm-server...

CVE-2023-49922 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat, cloudbeat-fips, elastic-agent-fips, elastic-agent, apm-server...

CVE-2026-48496 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GHSA-F2R5-5M7W-P5CX vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: mattermost, k9s-fips, kubescape-server-fips, cloudbeat, elastic-agent-fips, drone, cert-manager, chisel, commercial-grafana, kubernetes-fips, zarf-fips, tekton-pipelines-fips, tigera-operator, zarf, tekton-pipelines, gatekeeper, vault, gatekeeper-fips, kots, k9s,...

GO-2026-5611 Elastic Package Registry has Improper Verification of Cryptographic Signature in github.com/elastic/package-registry

Elastic Package Registry has Improper Verification of Cryptographic Signature in github.com/elastic/package-registry...

CVE-2026-40012

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...

EUVD-2026-39356

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...

CVE-2026-40012 Information about ECS zero scoped answers might leak to clients that use a specific ECS

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...