CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: gitlab-operator, helm-diff-fips, flux-source-controller, flux-source-controller-fips, kots, cert-manager-cmctl-fips, kuma, helm-push, zarf, zarf-fips, cilium-cli, flux-fips, rancher-fleet-fips, gitlab-operator-fips, flux, helm-diff, cert-manager-cmctl, rancher-fleet...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: gitlab-operator, helm-diff-fips, flux-source-controller, flux-source-controller-fips, kots, cert-manager-cmctl-fips, kuma, helm-push, zarf, zarf-fips, cilium-cli, flux-fips, rancher-fleet-fips, gitlab-operator-fips, flux, helm-diff, cert-manager-cmctl, rancher-fleet...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: gitlab-operator, helm-diff-fips, flux-source-controller, flux-source-controller-fips, kots, cert-manager-cmctl-fips, kuma, helm-push, zarf, zarf-fips, cilium-cli, flux-fips, rancher-fleet-fips, gitlab-operator-fips, flux, helm-diff, cert-manager-cmctl, rancher-fleet...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: gitlab-operator, helm-diff-fips, flux-source-controller, flux-source-controller-fips, kots, cert-manager-cmctl-fips, kuma, helm-push, zarf, zarf-fips, cilium-cli, flux-fips, rancher-fleet-fips, gitlab-operator-fips, flux, helm-diff, cert-manager-cmctl, rancher-fleet...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: helm-exporter, harbor, k9s, pluto, tigera-operator-fips, consul-k8s-fips, flux-source-controller-fips, helm-diff-fips, jfrog-cli, helm-set-status, kubescape-server, zarf-fips, cluster-api-helm-controller, k8ssandra-client-fips, cloudbeat, kubescape, eksctl,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: buildah, commercial-chainloop-cli, atlantis-fips, argo-cd, kubevirt-cdi-uploadserver, aws-load-balancer-controller-fips, omni-fips, envconsul, minio-fips, cloud-provider-aws, newrelic-fluent-bit-output-fips, grafana-fips, flux-source-controller,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: buildah, commercial-chainloop-cli, atlantis-fips, argo-cd, kubevirt-cdi-uploadserver, aws-load-balancer-controller-fips, omni-fips, envconsul, minio-fips, cloud-provider-aws, newrelic-fluent-bit-output-fips, grafana-fips, flux-source-controller,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: k8s-driver-manager-fips, nri-redis-fips, buildah, kyverno-notation-aws, prometheus-operator-fips, kserve-modelmesh-serving, commercial-chainloop-cli, prometheus-pgbouncer-exporter, atlantis-fips, rancher-pushprox, crossplane-provider-aws-acm, argo-cd,...

Kibana 8.x < 8.19.14 / 9.0.x < 9.2.8 / 9.3.x < 9.3.3 Multiple Vulnerabilities (ESA-2026-21 / ESA-2026-24 / ESA-2026-25 / ESA-2026-26)

The version of Kibana installed on the remote host is prior to 8.19.14, 9.2.8, or 9.3.3. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-21, ESA-2026-24, ESA-2026-25, and ESA-2026-26 advisories. - An incorrect authorization vulnerability in Kibana Fleet allows...

CVE-2026-4498

Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...

CVE-2026-33460

Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...

CVE-2026-33461

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...

Incorrect Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Incorrect Authorization via the enrollment endpoint. An attacker can access Fleet Server policy details from unauthorized spaces b...

Incorrect Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Incorrect Authorization via the Fleet internal API endpoint. An attacker can access sensitive configuration data, including privat...

Execution with Unnecessary Privileges

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Execution with Unnecessary Privileges in the Fleet plugin debug route handlers. An attacker can access index data outside of their...

Fleet Denial of Service Vulnerability (CNVD-2026-16892)

Fleet is Fleet Device Management open source a device management platform that supports a wide range of operating systems and devices to help IT and security teams with device management, vulnerability reporting, MDM and more. A denial of service vulnerability exists in Fleet versions prior to...

Fleet Access Control Error Vulnerability (CNVD-2026-16814)

Fleet is Fleet Device Management open source a device management platform that supports a wide range of operating systems and devices to help IT and security teams with device management, vulnerability reporting, MDM and more. An access control error vulnerability exists in Fleet versions prior t...

Fleet OS Command Injection Vulnerability

Fleet is Fleet Device Management open source a device management platform that supports a wide range of operating systems and devices to help IT and security teams with device management, vulnerability reporting, MDM and more. An operating system command injection vulnerability exists in Fleet...

EUVD-2026-20525

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...

EUVD-2026-20523

Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...