https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:04:57.168421+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-elk-2026-72650 BIT-elk-2026-72650 — Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure 2026-10-03T11:04:57.233949+00:00

Affected: Bitnami: elk

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1020 certfr-2026-avi-1020 — De multiples vulnérabilités ont été découvertes dans Elastic Kibana. Certaines d'entre elles permettent à un attaquant… 2026-10-03T11:04:57.234147+00:00 certfr-2026-avi-1020 https://cve.radiocsirt.org/vuln/euvd-2026-352336 EUVD-2026-352336 2026-10-03T11:04:57.234174+00:00 EUVD-2026-352336 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72650 fkie_cve-2026-72650 2026-10-03T11:04:57.234188+00:00

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

 https://cve.radiocsirt.org/vuln/ghsa-hcx4-m35m-r7xm GHSA-hcx4-m35m-r7xm 2026-10-03T11:04:57.234229+00:00

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2824 WID-SEC-W-2026-2824 — Kibana: Mehrere Schwachstellen 2026-10-03T11:04:57.234247+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um vertrauliche Informationen einschließlich Zugangsdaten offenzulegen, Daten und Konfigurationen zu manipulieren, Berechtigungen zu umgehen und einen Denial of Service zu verursachen.