GO-2025-4104 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester...

GO-2026-5538 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester...

GO-2024-3304 vulnerabilities

Vulnerabilities for packages: kubevela, docker-machine-driver-harvester, pulumi, rancher-machine...

GO-2024-2914 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, rancher-machine...

GO-2024-2500 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, rancher-machine...

GO-2022-0390 vulnerabilities

Vulnerabilities for packages: rancher-machine, docker-machine-driver-harvester, ctop...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: snyk-cli, kubescape-operator, spicedb-operator, harbor-registry, gomplate, terraform-provider-acme, sftpgo-plugin-auth, temporal-server, haproxy-ingress, gitlab-runner, temporal-ui-server, crossplane-provider-azure-authorization, kots,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: snyk-cli, terraform-provider-acme, gomplate, gitlab-runner, skaffold, crossplane-provider-azure-authorization, kots, k9s, knative-serving, flux-kustomize-controller, flux, atlantis, crossplane-provider-aws-sqs, datadog-agent, telegraf, eksctl, podman, scorecard,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kubescape-operator, nginx-prometheus-exporter, calico, docker-credential-gcr, kubernetes-dns-node-cache, harbor-registry, sftpgo-plugin-auth, temporal-ui-server, gitlab-runner, ferretdb, ghaudit, rancher-loglevel, container-object-storage-interface, rancher-telemetry...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, nginx-prometheus-exporter, docker-credential-gcr, harbor-registry, kubernetes-csi-driver-hostpath, chartmuseum, grafana-rollout-operator, libnvidia-container, harbor-cli, aws-otel-collector, cloud-sql-proxy, flux, bom, kubernetes-dashboard-auth,...

CVE-2026-72671

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...

CVE-2026-72642

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

CVE-2026-72629 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

EUVD-2026-58262

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

CVE-2026-72675

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

CVE-2026-72671

CVE-2026-72671 describes a missing authorization in Kibana’s Machine Learning feature that can allow an authenticated user with certain ML privileges to remove a trained model from a space without the trained-model privilege. The vulnerability affects Kibana ML capabilities that remove saved obje...

CVE-2026-72671 Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly...

Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92)

Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Description: Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88)

Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges...