21129 matches found
Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)
Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated...
CVE-2026-82918
Keyence XG VisionTerminal and XG-X VisionTerminal contain an XXE (XML External Entity) flaw: they improperly restrict XML external entity references. When a user opens a specially crafted setting file , sensitive information stored on the host system may be disclosed. The attack is local , requir...
CVE-2026-82918
XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where the affect...
Multiple Keyence products vulnerable to improper restriction of XML external entity reference
Overview XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation contain the following vulnerability. Improper restriction of XML external entity reference CWE-611 - CVE-2026-82918 Michael Heinzl reported these...
PT-2026-85024
Name of the Vulnerable Software and Affected Versions XG VisionTerminal affected versions not specified XG-X VisionTerminal affected versions not specified Description Keyence Corporation software improperly restricts XML external entity XXE references. XXE is a type of attack where an applicatio...
HPESBNW05145 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities
Potential Security Impact: Remote: Authentication Bypass, Denial of Service DoS, Unauthorized Data Injection, XML External Entity XXE SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 4.2.16 and below CVSS Scores: | CVE | CVSS Vector | Base Score | |...
CVE-2026-82918: Improper Restriction of XML External Entity Reference
XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where the affect...
CVE-2026-78596: Missing Authorization
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...
PT-2026-85214
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...
DRUPAL-CONTRIB-2026-121
This module enables you to automatically translate entities. The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the...
EUVD-2026-69222
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization...
CVE-2026-78601
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...
CVE-2026-78601 Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...
CVE-2026-78601 Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...
CVE-2026-78601
Kibana 9.4.0–9.4.4 contains a Missing Authorization flaw in the Entity Store configuration operation. An authenticated user with elevated Kibana privileges can indirectly cause a background task to read Elasticsearch indices they are not authorized to access, with derived entity data then exposed...
CVE-2026-78601 Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...
EUVD-2026-70054
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...
CVE-2026-81164
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...