Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-13505...

CVE-2026-109812

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

CVE-2026-109812

Some of Moxa's industrial computing products are susceptible to a missing authorization vulnerability in the internal API /api/v1/secrets/. A low-privileged authenticated attacker with adjacent network access can exploit this flaw to access sensitive information, which may lead to the disclosure ...

EUVD-2026-102593

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

PT-2026-115397

Name of the Vulnerable Software and Affected Versions Moxa industrial computing products affected versions not specified Description A missing authorization issue exists in the internal API endpoint /api/v1/secrets/. A low-privileged authenticated attacker with adjacent network access can exploit...

CVE-2026-109812: Missing Authorization

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

BIT-KIBANA-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

BIT-ELK-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

CVE-2026-102412

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

EUVD-2026-93933

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

CVE-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

CVE-2026-102412

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

CVE-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

CVE-2026-102412

Kibana versions 9.3.0 through 9.3.8 , 9.4.0 through 9.4.7 , and 9.5.0 through 9.5.4 are vulnerable to Incorrect Authorization (CWE-863) . An authenticated user with limited Fleet management privileges can bypass Access Control Lists (ACLs) to access sensitive credential material restricted to Fle...

Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management...

Kibana 9.x / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 Incorrect Authorization (ESA-2026-193)

The version of Kibana installed on the remote host is 9.3.x, or 9.4.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-193 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via...

CVE-2026-102412: Incorrect Authorization

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

Astra Linux – Vulnerability in Munge

MUNGE is an authentication service for creating and validating user credentials. From version 0.5 to 0.5.17, local attackers could exploit a buffer overflow vulnerability in MUNGE the authentication daemon to leak cryptographic key material from process memory. With the leaked key material,...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...