CVE-2026-63259

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

CVE-2026-63262

CVE-2026-63262 affects Kibana with Missing Authorization (CWE-862), enabling unauthorized cross-space information disclosure via user-supplied input that bypasses space-level access control. CVSSv3.1 base score is 4.3 (Medium) with network attack vector and low privileges required. Details indica...

CVE-2026-63967

A flaw was found in the Linux kernel's stlsm6dsx driver. This vulnerability occurs in the tagged FIFO First-In, First-Out buffer path, where a buffer on the stack is not properly initialized. A local attacker could exploit this by reading uninitialized memory from the kernel stack, leading to...

Kibana 9.4.4 Security Update (ESA-2026-73)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. Affected Versions: 9.4.x: All versions from 9.4.0 up to and...

CVE-2026-63965

A flaw was found in the Linux kernel's bmp280 pressure sensor driver. The bmp580triggerhandler function fails to initialize a stack-allocated buffer, which can lead to two bytes of uninitialized stack memory being exposed to userspace. This information disclosure vulnerability could allow a local...

CVE-2026-63259

CVE-2026-63259 affects Kibana and involves an Authorization Bypass via a user-controlled key, enabling potential information disclosure by referencing scheduled query result data in Kibana Spaces to which the requester lacks access. The CVSS 3.1 base score is 4.3 (Medium) with NETWORK attack vect...

CVE-2026-63259

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

CVE-2026-65314

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduc...

CVE-2026-63943

A flaw was found in the Linux kernel's xpad input driver. A local attacker with a specially crafted or malicious Xbox One controller could send a malformed input packet. This could lead to an out-of-bounds read, potentially causing a denial of service DoS or information disclosure...

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Author: Prakhar Porwal Date: 2026-05-24 Target: Gitea self-hosted Git service Branch tested: main @ b7e95cc48c development build, go1.26.3 Component: routers/api/v1/org/action.go org-level Actions API OWASP: API3:2023 Broken Object Property Level Authorization --- 1. Summary The org-level Actions...

CVE-2026-65319 Feedbin Unauthenticated Entry Content Disclosure via GET /api/v2/entries/:id/text

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...

CVE-2026-60927

...

CVE-2026-60832

...

CVE-2026-43947

FUXA vulnerability CVE-2026-43947 affects version 1.3.0 where, when secureEnabled is true, an unauthenticated user can trigger Remote Code Execution via POST /api/runscript with test: true if they know a valid script ID/name and at least one server-side script exists. The attack bypasses authoriz...

EUVD-2026-46403

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

EUVD-2026-46423

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialo...

EUVD-2026-46405

Tanium addressed a User Interface UI Misrepresentation of Critical Information vulnerability in Tanium Server...

EUVD-2026-46406

Tanium addressed an information disclosure vulnerability in Connect...

EUVD-2026-46396

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...

CVE-2026-47247 libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...