EUVD-2026-63831

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

CVE-2026-19435

The Duplicate Post WordPress plugin (also titled "Copy & Delete Posts") before 1.5.6 lacks a capability check before returning post data. An authenticated user with a delegated role can read the content, metadata, and passwords of posts they are not authorized to access, including other users' pr...

CVE-2026-73267 Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267

In Red Hat's multicluster engine, the clusterclaims-controller deletes ManagedClusters based solely on clusterclaim.spec.namespace without verifying ownership. Any tenant with standard ClusterClaim permissions can delete any cluster, including the hub's local-cluster, causing a HIGH-severity (7.7...

EUVD-2026-63693

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

EUVD-2026-63617

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

EUVD-2026-63691

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network...

EUVD-2026-63689

Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63688

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63623

Server-side request forgery ssrf in Azure Data Factory allows an unauthorized attacker to disclose information over a network...

EUVD-2026-63619

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

The vulnerability of the _validate_webhook_url() function in the mlflow/utils/validation.py file of the machine learning lifecycle management platform allows a attacker to perform an SSRF attack and gain unauthorized access to protected information.

The vulnerability of the validatewebhookurl function in the mlflow/utils/validation.py file of the machine learning lifecycle management platform is related to insufficient validation of server-side requests. Exploiting this vulnerability could allow an attacker to perform an SSRF attack and gain...

PT-2026-79413

Name of the Vulnerable Software and Affected Versions Omnigent versions prior to 0.3.0 Description The shared shell-command parser in omnigent/policies/builtins/ shell.py fails to recognize combined interpreter flags, command substitutions, a single background control operator, and wrappers such ...

Kibana 8.x < 8.19.17 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Vulnerability (ESA-2026-94)

The version of Kibana installed on the remote host is 8.x prior to 8.19.17, 9.0.x prior to 9.3.6, or 9.4.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-94 advisory. - Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of...

PT-2026-79332

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-124)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-124 advisory. - Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user...

PT-2026-79458

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.14.13 through 1.14.14 Nezha Monitoring versions 2.0.0 through 2.0.9 Description Nezha Monitoring fails to bind stream identifiers created by the CreateStream function in service/rpc/io stream.go to the user who...

PT-2026-79440

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

The vulnerability of the Apache HTTP Server’s web server, related to the disclosure of information in the erroneous data area, allows attackers to gain unauthorized access to the protected information.

The vulnerability of the Apache HTTP Server is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-79321

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.2.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An issue in the LDAP authentication plugin allows authenticated users to access sensitive information while listing LDAP...