https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:05:51.843869+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-elk-2026-72665 BIT-elk-2026-72665 — Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions 2026-10-03T04:05:51.912011+00:00

Affected: Bitnami: elk

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1020 certfr-2026-avi-1020 — De multiples vulnérabilités ont été découvertes dans Elastic Kibana. Certaines d'entre elles permettent à un attaquant… 2026-10-03T04:05:51.912077+00:00 certfr-2026-avi-1020 https://cve.radiocsirt.org/vuln/euvd-2026-352528 EUVD-2026-352528 2026-10-03T04:05:51.912100+00:00 EUVD-2026-352528 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72665 fkie_cve-2026-72665 2026-10-03T04:05:51.912113+00:00

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.

 https://cve.radiocsirt.org/vuln/ghsa-3wwx-7p3p-j479 GHSA-3wwx-7p3p-j479 2026-10-03T04:05:51.912139+00:00

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2824 WID-SEC-W-2026-2824 — Kibana: Mehrere Schwachstellen 2026-10-03T04:05:51.912157+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um vertrauliche Informationen einschließlich Zugangsdaten offenzulegen, Daten und Konfigurationen zu manipulieren, Berechtigungen zu umgehen und einen Denial of Service zu verursachen.