Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,902

CVE-2026-72665

Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-33465

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-78581

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72677

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72675

Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification

Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-72674

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2025-64649

Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Concert Linux Kernel
CVE-2026-16821

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aix Powervm Vios Vios
CVE-2026-74927

MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Multivendorx Wordpress
Products
Multivendorx Wordpress
CVE-2026-84430

gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gouguoa
Products
Gouguoa
CVE-2026-12526

Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-70951

Low‑Privilege Remote Exploit of Oracle Siebel CRM Document Management Enables Full Application Takeover

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Document Management). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in takeover of Siebel CRM End User. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Siebel Crm Siebel Crm End User
CVE-2026-29113

Craft has a potential information disclosure vulnerability in preview tokens

Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. This vulnerability is fixed in 4.17.3 and 5.9.7.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Craft Cms Craftcms
CVE-2026-19251

Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ultimatemember Wordpress
Products
Ultimate Member Wordpress
CVE-2026-19453

JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jetbackup Wordpress
Products
Jetbackup Wordpress
CVE-2026-77783

Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-77784

Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-77788

Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rank Math Seo Wordpress
Products
Rank Math Seo Wordpress
CVE-2026-69248

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pyca
Products
Cryptography