https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T09:23:09.133296+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-elk-2026-72666 BIT-elk-2026-72666 — Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts 2026-10-04T09:23:09.137827+00:00

Affected: Bitnami: elk

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1020 certfr-2026-avi-1020 — De multiples vulnérabilités ont été découvertes dans Elastic Kibana. Certaines d'entre elles permettent à un attaquant… 2026-10-04T09:23:09.137880+00:00 certfr-2026-avi-1020 https://cve.radiocsirt.org/vuln/euvd-2026-352527 EUVD-2026-352527 2026-10-04T09:23:09.137900+00:00 EUVD-2026-352527 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72666 fkie_cve-2026-72666 2026-10-04T09:23:09.137912+00:00

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.

 https://cve.radiocsirt.org/vuln/ghsa-jxv5-g6wh-9v24 GHSA-jxv5-g6wh-9v24 2026-10-04T09:23:09.137934+00:00

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2824 WID-SEC-W-2026-2824 — Kibana: Mehrere Schwachstellen 2026-10-04T09:23:09.137950+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um vertrauliche Informationen einschließlich Zugangsdaten offenzulegen, Daten und Konfigurationen zu manipulieren, Berechtigungen zu umgehen und einen Denial of Service zu verursachen.