Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-84308 — phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recov…

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular…

| Cryptography
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
6.5 MEDIUM
CVE-2026-63138 — Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Info…

Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affect…

kibana | Remote | Injection
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
4.3 MEDIUM
CVE-2026-78597 — Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticate…

kibana | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
7.3 HIGH
CVE-2026-78592 — Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthor…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-p…

kibana | Remote | Path Traversal
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
4.2 MEDIUM
CVE-2026-78606 — Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and D…

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two a…

kibana | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
4.3 MEDIUM
CVE-2026-78603 — Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Me…

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal El…

kibana | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
5.4 MEDIUM
CVE-2026-78607 — Missing Authorization in Elasticsearch Leading to Information Disclosure

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges co…

elasticsearch | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
6.5 MEDIUM
CVE-2026-78608 — Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, …

kibana | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
5.9 MEDIUM
CVE-2026-78605 — Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch …

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deplo…

elasticsearch | Remote | Information Disclosure
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
6.5 MEDIUM
CVE-2026-72654 — Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only…

kibana | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
4.3 MEDIUM
CVE-2026-72633 — Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitori…

Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user ho…

kibana | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
5.4 MEDIUM
CVE-2026-72641 — Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only Se…

kibana | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
6.5 MEDIUM
CVE-2026-72628 — Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service

Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could…

kibana | Remote | Denial of Service
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
6.5 MEDIUM
CVE-2026-72644 — Uncaught Exception in Kibana Leading to Denial of Service

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use th…

kibana | Remote | Denial of Service
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
8.8 HIGH
CVE-2026-72649 — Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artif…

elasticsearch | Remote | Injection
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
6.5 MEDIUM
CVE-2026-72682 — Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servi…

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent…

kibana | Remote | Denial of Service
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
8.3 HIGH
CVE-2026-63137 — Incorrect Authorization in Kibana Leading to Privilege Escalation

Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions…

kibana | Remote | Authorization
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
6.5 MEDIUM
CVE-2026-72652 — Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servi…

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted req…

kibana | Remote | Denial of Service
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
4.9 MEDIUM
CVE-2026-56143 — Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial o…

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a spec…

elasticsearch | Remote | Denial of Service
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
6.5 MEDIUM
CVE-2026-33465 — Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servi…

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could s…

kibana | Remote | Denial of Service
Sep 01, 2026 Sep 01, 2026
Sep 01, 2026
Sep 01, 2026
Showing 20 of 12404 Results