PT-2026-79935

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

PT-2026-80646

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requires key: branch. When the selected export plugin advertises requires key = False, the authorization check is skipped entirely and any authenticate...

PT-2026-79893

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

PT-2026-78672

IBM PowerVM Hypervisor Platform KeyStore PKS and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could...

PT-2026-78733

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...

PT-2026-79876

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

PT-2026-78730

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.10 Splunk Secure Gateway...

PT-2026-79924

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

PT-2026-78504

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions 4.0.0 through 4.14.4 Description A low-privilege read-only API user with manager:read permission can retrieve the cluster key from the ossec.conf element via the 'GET /manager/configuration?raw=true' endpoint. An attacke...

CVE-2026-76258: Use of Hard-coded Cryptographic Key

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile us...

PT-2026-78428

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Network Installation Management NIM could allow a remote attacker to bypass security restrictions. This issue occurs because intermediate certificate authority private keys...

PT-2026-78513

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process files from worker in framework/wazuh/core/cluster/master.py trusts a peer-controlled file path key from files metadata.json. The...

PT-2026-78832

In Splunk On-Call VictorOps app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface API key from the App Key Value Store KV Store. The exposure is possible because the Splunk On-Call...

Oracle Linux 9 : curl (ELSA-2026-55439)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55439 advisory. - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak via redirect and netrc CVE-2026-3783 - fix SSH host key...

PT-2026-79936

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

CVE-2026-44252: Incorrect Authorization

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...

PT-2026-79877

Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...

Linux Distros Unpatched Vulnerability : CVE-2026-23937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. CVE-2026-23937...

Malicious code in fast-glob-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408 fast-glob-fast is a name-squat of the popular fast-glob package its repository field even points at mrmlnc/fast-glob. The declared postinstall hook...

CVE-2026-55593

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...