Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-69)

Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A...

CVE-2026-62527

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Import And Export. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-61249

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Import And Export. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-60945

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-60948

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-62527

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Import And Export. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-14184 Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR

The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as complet...

PT-2026-62883

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

PT-2026-62884

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

PT-2026-63263

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An incorrect authorization issue exists in the Machine Learning functionality. A management endpoint performs an insufficient authorization check by validating only a coarse privilege level...

PT-2026-63266

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Uncontrolled Resource Consumption in Kibana can lead to a denial of service through excessive allocation. A low-privileged authenticated user can send a specially crafted request to a machine...

PT-2026-63115

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Import And Export. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-61249: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Import And Export. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-63261: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

CVE-2026-63145: Incorrect Authorization

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-62527: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Import And Export. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-60948: Improper Access Control

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-60945: Improper Access Control

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

PT-2026-63221

Name of the Vulnerable Software and Affected Versions Oracle Learning Management versions 12.2.3 through 12.2.15 Description An issue exists in the Import And Export component of the Oracle Learning Management product within Oracle E-Business Suite. A low privileged attacker with network access v...

CVE-2026-39878

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been...