EUVD-2026-46388

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...

EUVD-2026-46385

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

EUVD-2026-46444

The NXP LPUART serial driver drivers/serial/uartmcuxlpuart.c, when CONFIGUARTUSERUNTIMECONFIGURE is enabled, called LPUARTDeinit at the start of mcuxlpuartconfigure, which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards in mcuxlpuartconfigurebasic,...

CVE-2026-63139

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causin...

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file...

CVE-2026-52472

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file...

CVE-2026-52470

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file...

CVE-2026-63908

A flaw was found in the Linux kernel's atmelmxtts input driver. An incorrect boundary check when handling configuration files with oversized objects can lead to a single-byte overwrite in adjacent memory. This memory corruption vulnerability could allow a local attacker to potentially cause syste...

CVE-2026-63916

A flaw was found in the Linux kernel's Human Interface Device HID wacom driver. The wacomhidsetdevicemode function incorrectly handles the location of input mode data within a device's report. This can lead to an out-of-bounds write, where the system attempts to write data beyond the allocated...

CVE-2026-63894

A flaw was found in the Linux kernel's FunctionFS ffs component. A race condition exists where a Direct Memory Access Buffer DMABUF cancel operation can occur concurrently with a request completion, leading to a use-after-free vulnerability. This allows a privileged local attacker, such as a...

GHSA-RH79-75QM-GWJR Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

CVE-2026-63139

CVE-2026-63139 describes an Uncontrolled Resource Consumption (CWE-400) in Kibana, specifically targeting the Canvas functionality. An authenticated low-privilege user can trigger a specially crafted request that causes excessive allocation, leading to the Kibana server process termination and a ...

CVE-2026-63139 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causin...

GHSA-683J-3FF6-HH2X Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea's API endpoint for creating Personal Access Tokens POST /users/username/tokens is protected by a middleware reqBasicOrRevProxyAuth that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in t...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-56145

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive...

CVE-2026-49092

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

CVE-2026-56147

CVE-2026-56147 describes an Authorization Bypass in Kibana where a low-privileged authenticated user can bypass file access controls due to a mismatch between access checks and resource retrieval. The vulnerability enables unauthorized retrieval, modification, or deletion of case attachments (inc...

CVE-2026-56147 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

CVE-2026-63358

Summary of CVE-2026-63358 (FileGator privilege escalation) The affected software is FileGator. The vulnerability arises in the /chmoditems API endpoint, which accepts arbitrary Unix permission values and passes them directly to PHP’s native chmod() via octdec() without validation. This enables an...