CVE-2026-78603

Missing Authorization (CWE-862) in Kibana allows an authenticated user with minimal Elasticsearch privileges to bypass feature authorization and space access controls , leading to unauthorized disclosure of Fleet deployment metadata from the default Kibana space. The vulnerability leverages incor...

CVE-2026-78607

Elasticsearch custom inference service is affected by a Missing Authorization flaw (CWE-862) that allows a user with only inference execution privileges to redirect outbound inference traffic to an arbitrary destination and expose administrator-provisioned credentials . Affected versions are 8.0....

CVE-2026-78608

CVE-2026-78608 is a Missing Authorization (CWE-862) vulnerability in Kibana , where an internal APM integration function lacked a proper authorization check. This allowed any authenticated Kibana user to read APM server credentials that should only be accessible to users with APM or Fleet adminis...

CVE-2026-78605

Elasticsearch is affected by an HTTP Request Smuggling flaw (CWE-444) that can lead to information disclosure . Under specific proxy deployment configurations, a network attacker with no prior authentication could obtain confidential responses intended for other authenticated users. The CVSS 3.1 ...

CVE-2026-72654

CVE-2026-72654 is an Execution with Unnecessary Privileges (CWE-250) vulnerability in the Kibana machine learning feature . An operation available to users with only read access to the ML feature was executed using an internal service identity rather than the requesting user's own identity, allow...

CVE-2026-72633

Kibana Entity Analytics is affected by an Incorrect Authorization flaw (CWE-863) that allows an authenticated user with only read-level Security feature access —and no Elasticsearch privileges—to stop the recurring Privilege Monitoring engine task for a Kibana space. When this occurs, privileged ...

CVE-2026-72641

An Incorrect Authorization (CWE-863) flaw in Kibana allows an authenticated user holding only Security Solution read access in a Kibana space to enumerate and modify the state of Entity Store maintainer tasks , silently disabling Entity Analytics maintenance for that space. The root cause is func...

CVE-2026-72628

Kibana (by Elastic) is affected by a Denial of Service vulnerability (CWE-409) caused by improper handling of highly compressed data. An authenticated user with Streams management privileges can supply crafted content that expands to a much larger data volume during processing, exhausting memory ...

CVE-2026-72644

CVE-2026-72644 is a denial-of-service vulnerability in Kibana (Elastic). An authenticated user with only low-privileged access to the Observability AI Assistant can submit a specially crafted request that triggers an uncaught exception (CWE-248), terminating the Kibana process and denying service...

CVE-2026-72649

This CVE affects the Elasticsearch machine learning component , where a deserialization of untrusted data flaw (CWE-502) via object injection (CAPEC-586) permits remote code execution . A specially crafted trained model artifact can cause attacker-controlled logic to execute with a materially bro...

CVE-2026-72682

Kibana is affected by an unbounded memory allocation flaw (CWE-770) triggered via the Agent Builder feature. An authenticated user with only read-level Agent Builder privileges can submit a specially crafted request that causes Kibana to consume unbounded memory, terminating the process and denyi...

CVE-2026-63137

CVE-2026-63137 is an Incorrect Authorization (CWE-863) vulnerability in Kibana that enables privilege escalation. A user with workflow edit permissions can cause scheduled workflow executions to run under the privileges of a different, higher-privileged user, gaining access to and control over da...

CVE-2026-72652

CVE-2026-72652 is a denial of service vulnerability in Kibana caused by allocation of resources without limits or throttling (CWE-770) , triggered via Excessive Allocation (CAPEC-130) . An authenticated user can submit a specially crafted request that causes excessive resource consumption, potent...

CVE-2026-56143

CVE-2026-56143 is a Denial of Service vulnerability in Elasticsearch caused by Allocation of Resources Without Limits or Throttling (CWE-770) . An attacker with elevated privileges can submit a specially crafted request that triggers excessive memory allocation (CAPEC-130) , potentially rendering...

CVE-2026-33465

CVE-2026-33465 affects Kibana and involves a resource allocation without limits or throttling flaw (CWE-770). An authenticated user with low-level permissions can submit a specially crafted request that triggers excessive resource consumption, potentially rendering Kibana unavailable (denial of s...

CVE-2026-84307

CVE-2026-84307 affects Filament (a Laravel full-stack component collection) in versions 4.0.0 through 4.12.5 and 5.7.5. In packages/panels/src/Auth/Pages/Login.php, the multi-factor authentication (MFA) challenge is presented before the canAccessPanel() check. For accounts that have MFA enabled b...

CVE-2026-84306

Filament , a Laravel full-stack component library, is affected by a flaw in app-based multi-factor authentication (versions 4.0.0–4.12.6 and 5.7.6). In AppAuthentication::verifyCode(), the used-code cache key is derived from both the authentication secret and the submitted TOTP code , causing the...

CVE-2026-81846

CVE-2026-81846 is an authorization bypass in the runZero Platform MCP service , classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability allows a low-privilege network attacker to bypass authorization and access findings summaries data, resulting in a limited co...

CVE-2026-84305

sqlparse , a non-validating SQL parser for Python, is vulnerable to quadratic CPU consumption in versions prior to 0.6.0. When processing attacker-controlled parenthesized tuple lists via sqlparse.format(sql, reindent=True) or sqlformat --reindent, the ReindentFilter._get_offset() function in sql...

CVE-2026-84304

CVE-2026-84304 affects gRPC-Go , the Go implementation of gRPC, prior to version 1.83.1 . The root cause resides in internal/transport/transport.go, where each fragmented HTTP/2 DATA frame is stored as a separate recvMsg in the receive buffer. An unauthenticated remote attacker can exploit this b...

CVE-2026-84303

CVE-2026-84303 affects gRPC-Go (the Go implementation of gRPC). The xDS RBAC HTTP filter (internal/xds/httpfilter/rbac/rbac.go) fails to lowercase header matcher names in normalizeHeaderMatcher, while incoming metadata keys are already lowercase. A DENY policy using a mixed-case name (e.g., X-Rol...

CVE-2026-83551

Amazon SageMaker Python SDK versions prior to v3.11.0 and v2.256.0 store the HMAC signing key in cleartext within the @step and @remote decorator pipeline component. This allows an authenticated remote user to extract the key from SageMaker DescribePipeline API responses and forge valid integrity...

CVE-2026-8712

Wyoming before 1.10.2 contains a server-side request forgery (SSRF) vulnerability. Unauthenticated attackers with network access can supply a malicious uri query parameter containing arbitrary tcp:// or unix:// URIs to the HTTP API endpoints /api/info, /api/speech-to-text, and /api/text-to-speech...

CVE-2024-7953

CVE-2024-7953 is a Missing Authorization (CWE-862) vulnerability in Rockwell Automation DataMosaix Private Cloud versions 7.07 and prior . A threat actor with low privileges can remotely create a project and become its administrator , then create, modify, or delete that project. The CISA advisory...

CVE-2024-7952

Rockwell Automation's DataMosaix Private Cloud (versions 7.07 and prior ) is affected by a data exposure vulnerability (CWE-200). Hardcoded links in the source code point to JSON files that are accessible without authentication, allowing an unauthenticated remote attacker to view customer data. T...

CVE-2026-19592

OpenAI Codex CLI (v0.102.0–0.130.0) and Codex Desktop (Windows and macOS) executed a repository-supplied core.fsmonitor helper during background Git metadata collection, outside the command sandbox and without a user-approval prompt. An attacker who delivers a repository with its .git/config inta...

CVE-2026-19593

OpenAI Codex Desktop for Windows and macOS automatically inspects Git metadata when a workspace is opened. If the repository contains an attacker-controlled .git/config with the attr.tree setting and a configured clean or process filter, Git executes an attacker-controlled program outside Codex's...

CVE-2026-19591

OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) contain an approval-bypass flaw in their command-safety parser. The parser misinterprets PowerShell's stop-parsing token (--%), classifying certain commands as safe when they are not. An attacker who controls a repository...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because its automated Git operations trusted the repository-local core.hooksPath setting in .git/config. If a user opens a crafted repository where this setting points to an attacker-controlled directory, a mal...

CVE-2020-158581

CVE-2020-158581 is a reserved CVE entry with no public technical details currently available. The assigning organization has not yet announced the associated security problem. Action: monitor for updates when details are published.

CVE-2026-58566

CVE-2026-58566 is an Incorrect Authorization vulnerability in Dell PowerStore . A low-privileged attacker with remote network access could exploit it to achieve elevation of privileges , with a CVSS 3.1 base score of 8.8 (HIGH) — indicating high impact to confidentiality, integrity, and availabil...

CVE-2026-61769

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61769). An attacker with local access and low privileges (no user interaction required) can trigger the flaw, potentially leading to code execution , data tampering , and information disclosure . The...

CVE-2026-61777

NVIDIA Megatron Bridge is vulnerable to deserialization of untrusted data , which an attacker can exploit to achieve code execution , data tampering , and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) with a local attack vector , low complexity , and low privileges required ,...

CVE-2026-61778

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61778). An attacker with local access and low privileges, requiring no user interaction, could trigger the deserialization flaw, potentially leading to code execution, data tampering, and information...

CVE-2026-61779

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability that could allow an attacker to achieve code execution , data tampering , and information disclosure . The CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector , low complexity , and low privileges requir...

CVE-2026-61770

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A local attacker with low privileges (no user interaction required) could exploit this to achieve code execution, data tampering, and information disclosure , with high impact on confidentiality, integrity, a...

CVE-2026-61771

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61771). A successful exploit could lead to code execution, data tampering, and information disclosure . The CVSS v3.1 score is 7.8 (HIGH) with a local attack vector, low privileges required, and no u...

CVE-2026-61772

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability that could allow an attacker with local access and low privileges to achieve code execution, data tampering, and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector,...

CVE-2026-61773

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution, data tampering, and information disclosure . The assigned CVSS v3.1 score is 7.8 (HIGH) with a local attack vector , low complexity, and low privileges requi...

CVE-2026-61774

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution , data tampering , and information disclosure . The CVSS v3.1 score is 7.8 (HIGH) , with a local attack vector, low privileges required, and no user interacti...

CVE-2026-61775

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution, data tampering, and information disclosure . The CVSS v3.1 base score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, ...

CVE-2026-61776

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could result in code execution, data tampering, and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector , low complexity , low privileges requi...

CVE-2026-61766

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution , data tampering , and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges requi...

CVE-2026-61767

NVIDIA Megatron Bridge is vulnerable to deserialization of untrusted data , which could allow an attacker to achieve code execution, data tampering, and information disclosure . The vulnerability has a CVSS 3.1 base score of 7.8 (HIGH) with a local attack vector, low complexity, low privileges re...

CVE-2026-61768

NVIDIA Megatron Bridge is affected by a vulnerability where an attacker could cause deserialization of untrusted data . A successful exploit may lead to code execution, data tampering, and information disclosure . The CVSS 3.1 base score is 7.8 (HIGH) , with a local attack vector, low complexity,...

CVE-2026-61760

CVE-2026-61760 is a deserialization of untrusted data vulnerability (CWE-502) in NVIDIA Megatron Bridge , affecting versions 0.0 through 0.5.0 on all platforms. A successful local exploit with low privileges required could result in code execution, data tampering, and information disclosure , wit...

CVE-2026-61761

CVE-2026-61761 is one of 30 deserialization-of-untrusted-data flaws (CWE-502) in NVIDIA Megatron Bridge , an open-source framework for large-scale model training. The vulnerability requires local access with low privileges and no user interaction , yet can lead to code execution, data tampering, ...

CVE-2026-61762

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is vulnerable to deserialization of untrusted data (CWE-502). An attacker with local access and low privileges can exploit this to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) . The vulnerability affects ...

CVE-2026-61763

NVIDIA Megatron Bridge versions 0.0 through 0.5.0 are affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges can exploit this without user interaction to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIG...

CVE-2026-61764

CVE-2026-61764 is a deserialization of untrusted data vulnerability (CWE-502 ) in NVIDIA Megatron Bridge , affecting versions 0.0 through 0.5.0 on all platforms. A successful local exploit (low complexity, low privileges required) could lead to code execution, data tampering, and information disc...