917 matches found
CVE-2026-29181 vulnerabilities
Vulnerabilities for packages: external-secrets-operator, kubevirt-cdi-uploadserver, k8ssandra-client, argo-rollouts, crossplane-provider-aws-lambda-fips, db-operator, crossplane-provider-aws-secretsmanager-fips, crossplane-provider-aws-cognitoidentity-fips, crossplane-provider-aws-cloudsearch-fip...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: k8sgpt, percona-server-mongodb-operator, hubble, headlamp, docker-cli-buildx, rancher-fleet, gitlab-runner, argo-cd, kube-arangodb, argocd-image-updater, cluster-api, aws-node-termination-handler, k3s, emissary, falcoctl, consul-k8s, cilium, postgres-operator, k9s,...
CVE-2026-35469 vulnerabilities
Vulnerabilities for packages: k8sgpt, percona-server-mongodb-operator, hubble, headlamp, docker-cli-buildx, rancher-fleet, gitlab-runner, argo-cd, kube-arangodb, argocd-image-updater, cluster-api, aws-node-termination-handler, k3s, emissary, falcoctl, consul-k8s, cilium, postgres-operator, k9s,...
BIT-KIBANA-2026-4498 Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope
Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...
BIT-KIBANA-2026-33461 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...
BIT-KIBANA-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...
BIT-ELK-2026-4498 Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope
Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...
BIT-ELK-2026-33461 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...
BIT-ELK-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...
PT-2026-32409
Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...
PT-2026-32432
Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...
PT-2026-32407
Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...
PT-2026-32408
Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...
PT-2026-32433
Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...
CVE-2026-35204 vulnerabilities
Vulnerabilities for packages: flux, cilium-cli, flux-source-controller, kuma, rancher-fleet, cert-manager-cmctl, helm-push, zarf, kots...
GHSA-VMX8-MQV2-9GMG vulnerabilities
Vulnerabilities for packages: flux, cilium-cli, flux-source-controller, kuma, rancher-fleet, cert-manager-cmctl, helm-push, zarf, kots...
GHSA-Q5JF-9VFQ-H4H7 vulnerabilities
Vulnerabilities for packages: flux, cilium-cli, flux-source-controller, kuma, rancher-fleet, cert-manager-cmctl, helm-push, zarf, kots...
CVE-2026-35205 vulnerabilities
Vulnerabilities for packages: flux, cilium-cli, flux-source-controller, kuma, rancher-fleet, cert-manager-cmctl, helm-push, zarf, kots...
GHSA-HR2V-4R36-88HR vulnerabilities
Vulnerabilities for packages: flux, headlamp, rancher-fleet, helm-push, helm-operator, cerbos, cluster-api-helm-controller, kube-arangodb, helm-set-status, consul-k8s, chart-testing, k9s, pluto, teleport, zarf, kubescape, istio, flux-source-controller, envoy-gateway, helm-docs, trivy-operator, tw...
CVE-2026-35206 vulnerabilities
Vulnerabilities for packages: flux, headlamp, rancher-fleet, helm-push, helm-operator, cerbos, cluster-api-helm-controller, kube-arangodb, helm-set-status, consul-k8s, chart-testing, k9s, pluto, teleport, zarf, kubescape, istio, flux-source-controller, envoy-gateway, helm-docs, trivy-operator, tw...