13774 matches found
CVE-2026-72671 Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...
CVE-2026-72671
CVE-2026-72671 describes a missing authorization in Kibana’s Machine Learning feature that can allow an authenticated user with certain ML privileges to remove a trained model from a space without the trained-model privilege. The vulnerability affects Kibana ML capabilities that remove saved obje...
CVE-2026-72671 Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...
ai-threat-detection
css █████╗ ███╗ ██╗ ██████╗ ███████╗██╗ ██╗ ██╗█████...
OESA-2026-3402 podman security update
Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fixes: A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an O...
Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)
Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly...
Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92)
Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Description: Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122...
Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88)
Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges...
Characterizing the Variance Envelope: A Multi-Dimensional Analysis of Spectre Telemetry across Architectures and Workloads
Hardware attacks like Spectre exploit built-in processor vulnerabilities, leaving anomalous footprints in Hardware Performance Counter HPC metrics. While machine learning can detect these footprints in controlled settings, static models fail in the real world when confronted with background syste...
Weird Machines in Transport Layer Security
Weird machines are latent computational capabilities that emerge from the composition of architectural components. Prior work has studied this phenomenon extensively in software systems, including x86 instructions, ELF metadata, and page tables, and more recently in cyber-physical systems such as...
PT-2026-71781
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description A Kibana Machine Learning capability that removes a saved object from the current space incorrectly verifies privileges when targeting machine learning trained models. It only checks for...
CVE-2026-72642: Use of Out-of-range Pointer Offset
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...
CVE-2026-72671: Missing Authorization
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...
CVE-2026-72675: Missing Authorization
Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...
PT-2026-71785
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization in Kibana Machine Learning allows for cross-space information disclosure and unauthorized data modification. The system performs Elasticsearch operations using elevated...
UBUNTU-CVE-2026-16033
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...
Kioptrix-Lvl1-Exploitation
No d...
Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.7.1 security update
This is an updated version of the Machine Deletion Remediation Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Machine Deletion Remediation MDR Operator works with the Node Health Check NHC Operator to reprovision unhealthy nodes using the Machine API. The MDR...
CVE-2025-48505
Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution...
