1004477 matches found
RHSA-2026:56225 Red Hat Security Advisory: kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 security update
Bulletin has no description...
RHSA-2026:56223 Red Hat Security Advisory: grafana-pcp security update
Bulletin has no description...
RHSA-2026:56130 Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:56097 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Bulletin has no description...
RHSA-2026:56050 Red Hat Security Advisory: redhat-ds:12 security update
Bulletin has no description...
RHSA-2026:56028 Red Hat Security Advisory: pipewire security update
Bulletin has no description...
RHSA-2026:55405 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Bulletin has no description...
ROOT-APP-NPM-CVE-2026-26996 CVE-2026-26996 in minimatch - Patched by Root
Root has patched CVE-2026-26996 in the minimatch package for Root:npm. Multiple fixed versions available...
DEBIAN-CVE-2026-72889
Bulletin has no description...
ROOT-APP-NPM-CVE-2026-47429 CVE-2026-47429 in vitest - Patched by Root
Root has patched CVE-2026-47429 in the vitest package for Root:npm. Multiple fixed versions available...
MAL-2026-14296 Malicious code in gfff5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f12f82dc8c54282b428617c03537a54f3361841b02233b6626eae6f1e8ec4ee gfff5 advertises itself as a 'System binary configuration tool' but its actual behavior is covert surveillance. When the CLI is invoked, index.js...
ROOT-APP-GOBINARY-CVE-2025-47913 CVE-2025-47913 in golang.org/x/crypto - Patched by Root
Root has patched CVE-2025-47913 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-39829 CVE-2026-39829 in golang.org/x/crypto - Patched by Root
Root has patched CVE-2026-39829 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-39832 CVE-2026-39832 in golang.org/x/crypto - Patched by Root
Root has patched CVE-2026-39832 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-49346 CVE-2026-49346 in libde265 - Patched by Root
Root has patched CVE-2026-49346 in the libde265 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-49295 CVE-2026-49295 in libde265 - Patched by Root
Root has patched CVE-2026-49295 in the libde265 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-45382 CVE-2026-45382 in libde265 - Patched by Root
Root has patched CVE-2026-45382 in the libde265 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-49337 CVE-2026-49337 in libde265 - Patched by Root
Root has patched CVE-2026-49337 in the libde265 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-54241 CVE-2026-54241 in libde265 - Patched by Root
Root has patched CVE-2026-54241 in the libde265 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2023-51792 CVE-2023-51792 in libde265 - Patched by Root
Root has patched CVE-2023-51792 in the libde265 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2024-38949 CVE-2024-38949 in libde265 - Patched by Root
Root has patched CVE-2024-38949 in the libde265 package for Root:Debian:12. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-12816 CVE-2025-12816 in node-forge - Patched by Root
Root has patched CVE-2025-12816 in the node-forge package for Root:npm. Multiple fixed versions available...
BIT-POSTGRESQL-2026-19385 PostgreSQL pg_dump heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...
BIT-POSTGRESQL-2026-18024 PostgreSQL ascii() function reads past end of buffer
Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.1...
BIT-POSTGRESQL-2026-14677 PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixe...
BIT-POSTGRESQL-2026-14672 PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scramiterations count, because the authentication challenge for a...
BIT-POSTGRESQL-2026-14666 PostgreSQL row security caching disregards role modifications
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...
BIT-MONGODB-2026-13076 Aggregation Framework Memory Exhaustion Leading to Process Termination
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
BIT-KIBANA-2026-72674 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used t...
BIT-KIBANA-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...
BIT-KIBANA-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions
Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...
BIT-KIBANA-2026-72664 Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions
Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...
BIT-KIBANA-2026-72663 Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service
Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the...
BIT-KIBANA-2026-72659 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly...
BIT-KIBANA-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation
Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...
BIT-KIBANA-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification
Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...
BIT-KIBANA-2026-72653 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to...
BIT-KIBANA-2026-72630 Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation
Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...
BIT-KIBANA-2026-72629 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...
BIT-JUPYTERLAB-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...
BIT-JUPYTERLAB-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...
BIT-ELK-2026-72681 Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...
BIT-ELK-2026-72677 Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources
Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored...
BIT-ELK-2026-72666 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...
BIT-ELK-2026-72663 Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service
Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the...
BIT-ELK-2026-72653 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to...
BIT-ELK-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys
Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...