CVE-2026-73076

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function. Mitigation Avoid installing or removing vimballs from untrusted sources. This vulnerability...

CVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

PT-2026-72005

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for...

Linux Distros Unpatched Vulnerability : CVE-2026-73624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through...

PT-2026-71968

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

PT-2026-72074

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27 Description The install.php endpoint allows the action parameter to be set to reinstall without authentication. This bypasses the installation check because the security guard only executes when the $act variable...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory

An update for Red Hat OpenStack Platform 16.2 Train is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw...

Authorization Bypass Through User-Controlled Key

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the A2A JSON-RPC API endpoint. An attacker can overwrite and reassign another...

CVE-2026-72680

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-72680

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

EUVD-2026-58254

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714

CVE-2026-59714 describes a cross-channel message overwrite vulnerability in Open WebUI exposed by the chat-completions path. From v0.9.5 to before v0.10.0, an authenticated user could overwrite a message in a channel they do not belong to by using a channel: chat_id with a caller-supplied message...

CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

EUVD-2026-58246

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...