https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T00:01:08.776679+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352343 EUVD-2026-352343 2026-10-10T00:01:08.822745+00:00 EUVD-2026-352343 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72676 fkie_cve-2026-72676 2026-10-10T00:01:08.822785+00:00

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

 https://cve.radiocsirt.org/vuln/ghsa-hfcx-p43w-9wvx GHSA-hfcx-p43w-9wvx 2026-10-10T00:01:08.822823+00:00

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.