NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.
Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.
CVE-2026-119521 is a stored cross-site scripting (XSS) vulnerability in Cozmoslabs Paid Member Subscriptions affecting versions before 3.1.4. It allows improper neutralization of input during web page generation, potentially leading to execution of malicious scripts. The issue is fixed in version 3.1.4.
Metalama's Visual Studio integration uses a local named pipe for inter-process communication that deserializes messages without restricting CLR types, enabling local code execution. This unsafe deserialization affects all Metalama releases from 2023.0 through 2026.1.18 and is fixed in 2026.1.19. The pipe is accessible only by processes running as the same user, limiting exploitation to local same-user attackers. The vulnerability allows arbitrary code execution within the Visual Studio processes hosting Metalama components, impacting confidentiality, integrity, and availability of those processes. The practical severity is medium due to the same-user restriction and lack of privilege escalation. Remediation requires upgrading to Metalama 2026.1.19 or later, or updating affected Visual Studio extensions accordingly.
CVE-2026-121261 is a vulnerability in phpMyAdmin ShapeFile component versions 4.0.0 and 4.0.1. It affects the ShapeRecord::loadFromFile function in the SHP File Handler, allowing remote attackers to cause an infinite loop. The vulnerability has a medium severity score of 5.3 and public exploit details have been disclosed. The vendor has not responded to the disclosure and no patch information is available.
CVE-2026-121259 is a vulnerability in the GStreamer JPEG 2000 decimator component (gst-plugins-bad) that can cause integer overflows or division by zero when processing crafted JPEG 2000 media. This flaw may cause applications using this element to crash, resulting in a denial of service. The vulnerability affects Red Hat Enterprise Linux 10 and related products that ship vulnerable versions of gstreamer1-plugins-bad-free. No confidentiality or integrity impact has been demonstrated. Mitigation includes avoiding use of the jp2kdecimator element or rejecting untrusted JPEG 2000 media before processing.
Arc exposes an unauthenticated endpoint at GET /api/v1/logs that returns recent application logs without requiring authentication, despite authentication being enabled by default. This occurs because the route is registered before the global authentication middleware, causing the middleware to be bypassed. The logs can include operational metadata and potentially sensitive information, which could aid attackers. A fix is available that involves reordering route registration or adding explicit authentication checks.
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
CVE-2026-121604 is an out-of-bounds read vulnerability in wlroots versions before 0.20.2. It occurs in the read_surface_class() function within xwayland/xwm.c, allowing local X11 clients to leak compositor heap memory. The flaw arises when attackers set a WM_CLASS property with a NUL-terminated instance but an unterminated class, causing over-read heap bytes to be exposed as the window class or app_id over IPC.
Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.
Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.
TeXlyre versions from 0.11.0 up to but not including 0.13.5 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to execute malicious scripts by supplying crafted LSP or typesetter recipe icons containing HTML event handlers. Successful exploitation can lead to persistent script execution in victims' environments, potentially exposing local projects and repository credentials. The vulnerability is fixed in version 0.13.5.
Coolify versions before 4.1.1 have an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams. This occurs via manual GitHub, GitLab, Bitbucket, and Gitea webhooks by exploiting unescaped LIKE wildcards in repository name queries. The flaw is fixed in version 4.1.1.
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.