CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-67)

Missing Authorization in Kibana Leading to Unauthorized Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space...

GHSA-5QHF-9PHG-95M2 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while alloweduri?...

CVE-2026-62503

...

CVE-2026-62445

CVE-2026-62445 affects Oracle E-Business Suite’s Oracle Order Management (component: Product Diagnostic Tools). Affected versions are 12.2.4–12.2.15. The vulnerability is exploitable over the network with a low-privilege account via HTTP and can lead to unauthorized creation, deletion, or modific...

CVE-2026-60952

...

CVE-2026-60927

...

CVE-2026-60783

...

CVE-2026-60710

The CVE-2026-60710 entry concerns Oracle EDI Gateway (Oracle E-Business Suite) in the Internal Operations component, affected in versions 12.2.3–12.2.15. The vulnerability is exploitable over a network via HTTP by a low-privileged attacker, leading to unauthorized creation, deletion, or modificat...

CVE-2026-60704

...

CVE-2026-60403

CVE-2026-60403 affects Oracle TimesTen In-Memory Database (Kubernetes Operator component) with vulnerable version 26.1.1.1.0. An attacker with network access over HTTPS and low privileges can cause the database to hang or crash (DoS). CVSS 3.1 base score 6.5 (A:H; AV:N; AC:L; PR:L). No explicit e...

CVE-2026-47021

...

EUVD-2026-46377

Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in shmgeneric.h with openpath, ORDWR | OCREAT | OCLOEXEC, 0666. The mode is 0666, so under the default umask 022 the file is created mode 06...

CVE-2026-47709

libheif (HEIF/AVIF decoder/encoder) has a null pointer dereference in heif_image_handle_get_image_tiling for malformed uncompressed image items with uncC but no ispe. In debug builds this triggers an ispe && uncC assertion; in release/ASan builds it can cause a null read at address 0xa8. Affected...

CVE-2026-43946 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue...

CVE-2026-65316 xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

CVE-2026-65316

XXL-Job version 2.4.2 is affected by an insecure direct object reference in the logDetailCat endpoint, enabling authenticated users to read execution logs from job groups they’re not authorized to access by supplying arbitrary sequential logId values. This allows cross-group disclosure of potenti...

CVE-2026-65316 xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

CVE-2026-65055

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filtersdata API endpoints on UserStory, Task, Issue, and Epic viewsets...

CVE-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...