PT-2026-84741

Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls...

CVE-2026-83551

creationtimestamp| type| source ---|---|--- 2026-09-01 23:20:10+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3muikoiggdb2q 2026-09-03 20:32:45+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3muncay5iri2q...

CVE-2026-84470 Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-84470 Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-72633

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

CVE-2026-33465

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...

CVE-2021-1137

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:47+00:00| seen| https://t.me/hackingAttack/4295 2026-09-01 20:02:47+00:00| seen| https://t.me/hackingAttack/4296 2026-09-02 01:03:23+00:00| seen| https://t.me/hackingAttack/4296 2026-09-02 01:03:24+00:00| seen|...

CVE-2021-36654

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:30+00:00| seen| https://t.me/hackingAttack/19109 2026-09-02 01:03:04+00:00| seen| https://t.me/hackingAttack/19109 2026-09-07 21:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/19109 2026-09-08 00:00:23+00:00|...

CVE-2021-35323

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:09+00:00| seen| https://t.me/hackingAttack/31750 2026-09-02 01:02:35+00:00| seen| https://t.me/hackingAttack/31750 2026-09-07 05:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/31750 2026-09-08 00:01:00+00:00|...

CVE-2022-31897

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:35+00:00| seen| https://t.me/hackingAttack/58348 2026-09-02 01:01:45+00:00| seen| https://t.me/hackingAttack/58348 2026-09-05 16:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/58348 2026-09-06 00:00:42+00:00|...

EUVD-2026-69436

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacke...

CVE-2026-72633

Kibana Entity Analytics is affected by an Incorrect Authorization flaw (CWE-863) that allows an authenticated user with only read-level Security feature access —and no Elasticsearch privileges—to stop the recurring Privilege Monitoring engine task for a Kibana space. When this occurs, privileged ...

EUVD-2026-69566

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

CVE-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

CVE-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

Kibana 9.4.6, 9.5.2 Security Update (ESA-2026-130)

Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only...

CVE-2026-83606

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

UBUNTU-CVE-2026-83613

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode...

CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...