CVE-2026-78607

Missing Authorization in Elasticsearch Leading to Information Disclosure

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-78605

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-72654

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather than the identity of the requesting user. Such a user could therefore receive data from Elasticsearch indices they are not authorized to read. No Elasticsearch cluster or index privileges are required.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72649

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-49096

Uncaught Exception in Kibana Cases Leading to Denial of Service

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72630

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation

Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72631

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-16139

Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Sharefile Storage Zones Controller

CVE-2026-18297

GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29584.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2026-16138

Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Sharefile Storage Zones Controller

CVE-2026-16137

Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Sharefile Storage Zones Controller

CVE-2026-18298

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2026-18299

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2026-18309

GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29401.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gimp

Products

Gimp

CVE-2026-65937

WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Whatsup Gold Whatsup Gold

CVE-2026-65938

WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Whatsup Gold Whatsup Gold

CVE-2026-65939

WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Whatsup Gold Whatsup Gold

CVE-2026-65940

WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Whatsup Gold Whatsup Gold

CVE-2026-84200

Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Kyverno

Products

Kyverno

CVE-2026-83744

invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery

A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Invoiceninja

Products

Invoice Ninja