https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:24:47.151643+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-elk-2026-72631 BIT-elk-2026-72631 — Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys 2026-10-03T19:24:47.205087+00:00

Affected: Bitnami: elk

Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1020 certfr-2026-avi-1020 — De multiples vulnérabilités ont été découvertes dans Elastic Kibana. Certaines d'entre elles permettent à un attaquant… 2026-10-03T19:24:47.205143+00:00 certfr-2026-avi-1020 https://cve.radiocsirt.org/vuln/euvd-2026-352376 EUVD-2026-352376 2026-10-03T19:24:47.205164+00:00 EUVD-2026-352376 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72631 fkie_cve-2026-72631 2026-10-03T19:24:47.205177+00:00

Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

 https://cve.radiocsirt.org/vuln/ghsa-fgm9-rcvc-p7vm GHSA-fgm9-rcvc-p7vm 2026-10-03T19:24:47.205200+00:00

Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2824 WID-SEC-W-2026-2824 — Kibana: Mehrere Schwachstellen 2026-10-03T19:24:47.205217+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um vertrauliche Informationen einschließlich Zugangsdaten offenzulegen, Daten und Konfigurationen zu manipulieren, Berechtigungen zu umgehen und einen Denial of Service zu verursachen.