CVE-2026-102413 is an uncaught exception vulnerability in Elastic Endpoint, part of Elastic Agent and Elastic Defend, triggered by processing specially crafted file names under certain system locale settings on Windows. This causes the Elastic Endpoint process to crash and restart repeatedly, potentially degrading or disabling real-time malware prevention and behavioral detection on the affected host. The issue affects multiple versions from 8.19.13 through 9.5.4. The vulnerability has a CVSS score of 6.2, indicating medium severity.
CVE-2026-102412 is an incorrect authorization vulnerability in Elastic Kibana affecting versions 9.3.0 through 9.3.8, 9.4.0 through 9.4.7, and 9.5.0 through 9.5.4. It allows an authenticated user with limited Fleet management privileges to access sensitive credential material that should be restricted to Fleet settings administrators. This could lead to disclosure of private cryptographic key material used for Fleet Server host connections. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-102411 is a resource allocation vulnerability in Elasticsearch where multiple template resources with user-supplied metadata can collectively exhaust heap memory, causing node failure and denial of service. The issue arises because while individual metadata fields have size limits, the total memory used when retrieving multiple such resources together is not limited. This affects Elasticsearch versions 8.0.0 through 8.19.22, 9.0.0 through 9.4.6, and 9.5.0 through 9.5.2. The vulnerability requires the attacker to have the manage_index_templates cluster privilege. The CVSS score is 6.5 (medium severity) with no confidentiality or integrity impact but high availability impact.
CVE-2026-102410 is a medium severity vulnerability in Elastic Kibana versions 9.2.0 through 9.3.8. It involves missing authorization checks in an internal API within the Metrics Experience feature, allowing users with only data-store-level read access to retrieve metric data that should require higher Kibana feature privileges. This flaw results from inconsistent enforcement of access control lists (ACLs) between related APIs in the same feature.
CVE-2026-102409 is an uncontrolled recursion vulnerability in Elastic Elasticsearch that allows an authenticated user with low privileges to cause a denial of service by terminating an Elasticsearch node. The issue arises from excessive allocation leading to resource exhaustion. It affects multiple 9.x versions of Elasticsearch. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild and no official patch information is provided in the source data.
CVE-2026-102408 is a medium severity vulnerability in Elastic Elasticsearch involving inefficient regular expression complexity. The ES|QL CHUNK function accepts user-supplied regular expressions without validating their computational complexity or bounding execution time. An authenticated user with read access to any text-based index can submit crafted regex patterns that cause catastrophic backtracking, leading to excessive CPU consumption and degraded query throughput on affected nodes. The issue results in denial of service conditions but does not crash the cluster.
CVE-2026-102407 is an incorrect authorization vulnerability in Elastic Elasticsearch that allows an authenticated user with privileges on one resource to modify data streams they are not authorized to access. This vulnerability affects multiple Elasticsearch versions from 7.17.5 through 9.4.3. It does not permit unauthorized reading of data stream contents but can lead to unauthorized modification or injection of data, potentially disrupting search functionality. The CVSS score is 5.4, indicating medium severity.
CVE-2026-102406 is a high-severity authorization bypass vulnerability in Elastic Kibana affecting versions 8.14.0 through 8.19.21, 9.0.0 through 9.4.6, and 9.5.0 through 9.5.3. It allows a user with delegated Fleet package-management privileges to claim a data stream identifier already in use by another tenant without proper ownership verification. This can lead to cross-tenant data interception, unauthorized disclosure, modification, and disruption of data delivery. The interception may persist even after the malicious package is removed, requiring additional remediation of the affected infrastructure.
CVE-2026-102404 is a medium severity vulnerability in Elastic Elasticsearch affecting versions 8.0.0 through 8.19.22, 9.0.0 through 9.4.7, and 9.5.0 through 9.5.4. It involves uncontrolled resource consumption (CWE-400) where a low-privileged authenticated user can submit crafted queries that cause excessive memory allocation. This leads to out-of-memory conditions that terminate Elasticsearch nodes, potentially causing persistent cluster unavailability.
CVE-2026-76061 is a medium severity vulnerability in Red Hat OpenShift Container Platform 4 related to improper link resolution before file access in CRI-O's bind_mount_prefix handling. A malicious container or local attacker can exploit this by using a Container Runtime Interface (CRI) hostPath with an intermediate absolute symlink, potentially causing the bind mount source to resolve outside the intended directory. This may lead to unauthorized file access or privilege escalation on the host system.
During the first day of the Pwn2Own Ireland 2026 competition, security researchers exploited 32 zero-day vulnerabilities, including two successful hacks of the Samsung Galaxy S26 flagship device. The event targets multiple categories such as mobile phones, printers, smart home devices, AI infrastructure, and wellness healthcare devices. Some exploited bugs were already known to vendors. The Zero Day Initiative (ZDI) organizes the event to discover zero-days before threat actors can exploit them, giving vendors 90 days to patch after disclosure.
CVE-2026-106443 is a high-severity remote code execution vulnerability in Kozea WeasyPrint that arises from improper input validation. WeasyPrint passes untrusted image bytes directly to Pillow's format dispatcher without restricting input formats. When Ghostscript is installed on the host, Pillow's EPS image plugin invokes Ghostscript to rasterize EPS/PS input, allowing attacker-controlled PostScript to execute. Hosts running vulnerable Ghostscript versions with known -dSAFER bypasses can be fully compromised. The vulnerability affects WeasyPrint versions prior to 70.0 and impacts any deployment rendering untrusted content on hosts with Ghostscript installed.
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.
CVE-2026-79818 is a medium severity vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). It involves an API interface flaw that allows an unauthenticated remote attacker to bypass authentication controls. Exploiting this vulnerability could enable the attacker to access sensitive information from the affected system. The vulnerability affects specific versions of CPPM, including 6.11.0 through 6.11.15 and version 6.14.0. No known exploits are reported in the wild, and no patch information is provided.
CVE-2026-79817 is a medium severity vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager client software that allows local attackers with limited privileges to disclose sensitive information. The vulnerability does not require user interaction and impacts confidentiality without affecting integrity or availability.
CVE-2026-79816 is a medium severity vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM) that allows an unauthenticated remote attacker to perform a DOM-based cross-site scripting (XSS) attack via a client interface. Exploitation could enable execution of arbitrary script code in the victim's browser within the affected interface. The affected versions are 6.11.0 through 6.11.15 and exactly 6.14.0. No known exploits are reported in the wild. No patch or remediation information is provided in the available data.
CVE-2026-79815 is a command injection vulnerability in the OnGuard agent of Hewlett Packard Enterprise's ClearPass Policy Manager (CPPM). It allows an authenticated remote attacker to inject arbitrary commands, potentially executing them with elevated privileges on the affected Windows endpoint. The vulnerability affects specific versions of CPPM, including 6.11.0 through 6.11.15 and version 6.14.0. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
CVE-2026-79814 is an arbitrary file write vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager OnGuard agent. It allows a local user with limited privileges to elevate their privileges by writing arbitrary files if certain conditions outside their control are met. Exploitation could lead to arbitrary code execution with elevated privileges on the affected system. The vulnerability affects specific versions of ClearPass Policy Manager. The CVSS score is 6.7, indicating a medium severity level.
CVE-2026-79813 is a local privilege escalation vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM) client software. It allows a low-privileged local user to execute commands with elevated privileges if certain external conditions are met. The vulnerability affects specific versions of CPPM client software. The CVSS score is 6.7, indicating a medium severity level. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.
CVE-2026-79812 is a denial of service vulnerability in the OnGuard agent of Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). An authenticated local attacker could exploit this flaw to disrupt the normal operation of the agent service. The vulnerability affects specific versions of CPPM, including 6.11.0 through 6.11.15 and version 6.14.0. The CVSS v3.1 base score is 6.1, indicating a medium severity impact primarily due to availability disruption.