BIT-ELK-2026-72650 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...

clawpatrol v0.5.9

clawpatrol The security firewall for agents. Claw Patrol sits between your agents and prod, parses their traffic at the wire, and gates each action against rules you write in HCL. For example, you can block destructive SQL, or pause kubectl delete pod until a human approves it before the request...

PT-2026-79879

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...

PT-2026-78541

Name of the Vulnerable Software and Affected Versions Grafana OSS version 13.0.1 Description An authenticated low-privileged user with permissions to create or edit alert rules in a folder can bypass datasource permission enforcement. By setting the client-controlled queryType variable to expr...

CVE-2026-17183: Incorrect Authorization

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

PT-2026-78651

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.89 Description An improper authorization issue exists in the Boards.allow update rule within server/permissions/boards.js, which utilizes the canUpdateBoardSort function in server/lib/utils.js. This allows any board...

certgraveyard_yara v2026.08.18

CertGraveyard YARA Rules Generator Automated YARA rule generation from the CertGraveyard compromised certificate database. Features 🔄 Daily Updates : Automatically checks CertGraveyard for new compromised certificates 📝 YARA Rule Generation : Creates individual YARA rules for each certificate ✅...

SUSE CVE-2026-70452

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the ru...

CVE-2026-19869: Authorization Bypass Through User-Controlled Key

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

Linux Distros Unpatched Vulnerability : CVE-2026-72312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes...

ANT-2026-DD4RKCBA · OpenSC · Stack Buffer Overflow

stack-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-DD4RKCBA: Stack buffer overflow in...

CVE-2026-19986

The CVE-2026-19986 case concerns Adblock for Youtube Extension (Chrome) up to 7.2.1. The vulnerability lies in the updateDynamicRules function in contentscript.js of the Event Listener, where manipulation of the yt-anti-adblock-detected argument leads to improper authorization. The issue enables ...

PT-2026-76725

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x astro path for the public / isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

fail2ban v1.1.1

root@kitploit: / | | | | / | | |/ /| ' / | ' \ || ,||/|./,|||| v1.1.0.dev1 20??/??/?? Fail2Ban: ban hosts that cause multiple authentication errors Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system...

CVE-2026-72312

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72312

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72312 octeontx2-af: fix VF bringup affecting PF promiscuous state

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72312 octeontx2-af: fix VF bringup affecting PF promiscuous state

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nixsetrxmode for a VF with promiscuous and allmulti flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs...

CVE-2026-72312

CVE-2026-72312 affects the Linux kernel component octeontx2-af and fixes an issue where VF bringup could erroneously modify the PF’s promiscuous/allmulti MCAM rules. The root cause was that mbox handling of nix_set_rx_mode (and related APIs) acted only on the PF, not the VF, potentially clearing ...

PT-2026-72724

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fib rules component where the fib rules dump function may attempt to dump a dying fib rule. This occurs because rocker router fib event calls fib rule get during a...