EUVD-2026-70067

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

CVE-2026-78588 Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Filebeat can lead to a denial of service via Excessive Allocation CAPEC-130. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the...

CVE-2026-78588

Filebeat (Elastic) is affected by an uncontrolled resource allocation vulnerability (CWE-770) in its HTTP ingestion endpoint . An attacker with network access to this endpoint can send specially crafted compressed requests that exhaust the memory of the Filebeat process, causing a denial of servi...

CVE-2026-78588 Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Filebeat can lead to a denial of service via Excessive Allocation CAPEC-130. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the...

CVE-2026-78586 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, renderin...

CVE-2026-78586 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, renderin...

EUVD-2026-70064

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, renderin...

CVE-2026-78586 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, renderin...

EUVD-2026-70062

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

CVE-2026-78590

A Path Traversal (CWE-22) vulnerability in the Kibana Fleet feature allows a low-privileged user with Fleet Settings write access to manipulate subsequent administrative actions so they target unintended internal resources, leading to unauthorized deletion of privileged resources such as user acc...

GHSA-FF5C-CP5C-9WJF NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk.parse.RecursiveDescentParser and SteppingRecursiveDescentParser enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU and/or exhaust the Python recursion stack, pinning a process indefinitely ...

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk.parse.RecursiveDescentParser and SteppingRecursiveDescentParser enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU and/or exhaust the Python recursion stack, pinning a process indefinitely ...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-81158

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0...

kernel: Squashfs: sanity check symbolic link size

A vulnerability was found in the Linux kernel involving the use of uninitialized resources. When a corrupted symbolic link size read is called from the disk, it causes an uninitialized page, resulting in loss of availability of the system...

kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

A resource exhaustion vulnerability was found in the Kernel Same-page Merging KSM subsystem of the Linux kernel. When scanning processes with large sparse virtual memory mappings e.g., 32 TiB with one mapped page, ksmd inefficiently walks every address rather than skipping unmapped holes. This...