https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T16:04:26.308308+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-elk-2024-11390 BIT-elk-2024-11390 — Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS 2026-10-05T16:04:26.366676+00:00

Affected: Bitnami: elk

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.

The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0359 certfr-2025-avi-0359 — De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un atta… 2026-10-05T16:04:26.366735+00:00 certfr-2025-avi-0359 https://cve.radiocsirt.org/vuln/euvd-2026-236209 EUVD-2026-236209 2026-10-05T16:04:26.366756+00:00 EUVD-2026-236209 https://cve.radiocsirt.org/vuln/fkie_cve-2024-11390 fkie_cve-2024-11390 2026-10-05T16:04:26.366768+00:00

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.

The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

 https://cve.radiocsirt.org/vuln/ghsa-mv8v-9jrg-2c2w GHSA-mv8v-9jrg-2c2w 2026-10-05T16:04:26.366792+00:00

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.

The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0917 WID-SEC-W-2025-0917 — Kibana: Mehrere Schwachstellen 2026-10-05T16:04:26.366809+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Daten zu manipulieren.