CVE-2026-13184

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock...

CVE-2026-13184 RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock...

i2c: i801: fix hardware state machine corruption in error path

...

EUVD-2026-47584

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

EUVD-2026-47589

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

UBUNTU-CVE-2026-55868

Encryption State Machine Downgrade...

CVE-2026-63145

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-63261 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

CVE-2026-63261

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

CVE-2026-63261

CVE-2026-63261 describes an uncontrolled resource consumption (CWE-400) in Kibana, leading to denial of service via excessive memory allocation. The issue is triggered by a low-privileged authenticated user sending specially crafted requests to the Kibana machine learning feature, which can exhau...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-72)

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning...

CVE-2026-63145 Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-63145

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-63145

Kibana Machine Learning (ML) functionality is affected by an Incorrect Authorization (CWE-863) vulnerability. A management endpoint performs only a coarse privilege check and does not verify that the requesting user has access to the specific ML job or notification resources referenced in the req...

CVE-2026-63145 Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-69)

Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A...

CVE-2026-63940

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM Secure Encrypted Virtualization SEV module. This vulnerability occurs because the system does not properly handle Port I/O requests with a length of zero. An attacker, potentially from a guest virtual machine, could exploit...

CVE-2026-63939

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV support. This vulnerability arises from an incorrect calculation of the maximum length for the in-Guest-Host Communication Block GHCB scratch area. When processing Page State Change PS...

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 CVSS score: 9.8, a critical deserialization of untrusted data in Microsoft Office SharePoint tha...

SUSE CVE-2026-63913

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...