CVE-2026-16713 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address...

MINI-2GCG-J3RF-FPWF

Bulletin has no description...

CGA-J9H8-5CM9-WR95

Bulletin has no description...

EUVD-2026-58221

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

CVE-2026-72632 Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

CVE-2026-72632 Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

CVE-2026-72632

Kibana Fleet vulnerability CVE-2026-72632 allows an information disclosure of Elasticsearch API keys through a side-channel in the agent listing API. Root cause: Fleet evaluated caller-supplied filter expressions against the stored API-key field using Kibana’s internal Elasticsearch privileges, l...

CVE-2026-72632

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

CVE-2026-72643

CVE-2026-72643 describes an Incorrect Authorization in Kibana Agent Builder where a caller’s ownership check uses a stable user identifier or falls back to username, which is not unique across Elasticsearch realms. This allows disclosing the configuration/instructions of an agent the caller does ...

CVE-2026-72648

Elastic Cloud on Kubernetes (ECK) has a vulnerability CVE-2026-72648 where a Fleet Server authentication token is written in cleartext into the generated workload specification instead of being mounted from the Kubernetes Secret. This allows principals with access to workload specs in the affecte...

EUVD-2026-58281

Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...

CVE-2026-72648

Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...

CVE-2026-72648 Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure

Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...

CVE-2026-72657 Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...

CVE-2026-72657

Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...

CVE-2026-72657

The vulnerability CVE-2026-72657 affects Elastic Fleet Server and allows an Authorization Bypass through a user-controlled key, enabling information disclosure via manipulated user-controlled variables. Root cause: a client-supplied value used for authorization was persisted without server-side v...

EUVD-2026-58280

Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...

CVE-2026-72650 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...

CVE-2026-72650 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...

CVE-2026-72650

CVE-2026-72650 affects Kibana; the root cause is an authorization bypass through a user-controlled key (CWE-639). An authenticated user with read-access to alerting rules in a single Kibana space could retrieve alerting rule execution telemetry from other spaces, exposing identifiers, names, spac...