A vulnerability in Elasticsearch allows an authenticated user with restricted index access to retrieve values from constant_keyword fields that their role should exclude. This occurs because some search and query features do not enforce field-level security restrictions on this field type, leading to potential information disclosure.
A vulnerability in Kibana Observability onboarding allows insertion of sensitive information into sent data, exposing credentials used by Kibana to connect to Elasticsearch. Authenticated users with privileges to onboard Observability data can retrieve these credentials embedded in Elasticsearch host URLs, potentially gaining unauthorized access to Elasticsearch with Kibana service account privileges.
A missing authorization vulnerability exists in WPVibes AnyWhere Elementor plugin versions up to 1.3.0. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-115295 is an authorization bypass vulnerability in Kibana where an authenticated user with read access to connectors in one space can access connector execution logs from other unauthorized spaces. The exposed information includes connector names, identifiers, execution status, timestamps, error messages, and aggregated execution statistics. This vulnerability is due to improper access control enforcement (CWE-639).
A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw can lead to unauthorized modification of information without user interaction. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A vulnerability in WPVibes AnyWhere Elementor (up to version 1.3.0) allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data to unauthorized parties. The flaw is identified as CVE-2026-114183 and has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-103916 is a vulnerability in Docker Sandboxes' sbx cp command where host-side paths are not properly confined to a shared workspace. This flaw allows a malicious sandbox to manipulate workspace symlinks, enabling unauthorized reading of host files into the sandbox or writing sandbox-controlled data to host paths outside the workspace with the invoking user's permissions.
An unauthenticated attacker with network access to SonicWall GMS versions 9.5.2 and earlier may read internal files, potentially exposing sensitive information. This vulnerability has a high impact on confidentiality and availability.
CVE-2026-115290 is a high-severity vulnerability in Elasticsearch caused by uncontrolled recursion in handling serialized data with nested payloads. An unauthenticated attacker with network access to a cluster node can send a crafted request that triggers node termination, resulting in denial of service. No credentials are required, and the attack can be repeated against each reachable node in the cluster.
CVE-2026-115292 is an authorization bypass vulnerability in Kibana Machine Learning. An authenticated user with read access to Machine Learning in one Kibana space can access audit and error messages of data frame analytics jobs in other spaces without proper authorization. These messages may disclose sensitive job details such as destination index names, analyzed field names, and failure information. The vulnerability is rated medium severity with a CVSS score of 4.3.
NVIDIA Slurm has a heap-based buffer overflow vulnerability in the slurmstepd socket handling code that can be controlled by an attacker. This flaw allows for potential high impact on confidentiality, integrity, and availability. The vulnerability has a high severity rating with a CVSS score of 7. No affected versions or patch information are currently provided.
NVIDIA Slurm has a vulnerability that allows a user to manipulate the nodelist parameter along with the --distribution=arbitrary option to gain unauthorized access to compute nodes outside their allocated job. This flaw could lead to unauthorized read access to compute nodes, but does not affect integrity or availability.
NVIDIA Slurm contains a vulnerability involving an attacker-controlled SQL injection in certain SlurmDBD RPCs, which can lead to arbitrary code execution. The vulnerability has a CVSS score of 6.3, indicating medium severity. No affected versions or patch information are provided.
NVIDIA Slurm has a vulnerability in the slurmstepd socket API that allows an attacker to perform arbitrary memory reads. This flaw could be exploited to exfiltrate authentication keys, potentially compromising system security. The vulnerability has a CVSS score of 6.3, indicating a medium severity level. No affected versions or patch information are currently provided.
NVIDIA Slurm has inconsistent authorization checks in the SlurmDBD component related to the Operator permission level. These inconsistencies can be chained to allow an Operator to escalate their privileges to Administrator.
NVIDIA Slurm contains a symlink resolution vulnerability in its container cleanup code that could allow an attacker with limited privileges to remove files outside their control on the compute node. This issue does not affect confidentiality or availability but impacts integrity by enabling unauthorized file deletion.
FastBee versions through 2.1.0 have an insecure direct object reference (IDOR) vulnerability in the ProductController. Authenticated tenant users can exploit this flaw to access products belonging to other tenants by providing their product IDs. This allows attackers to enumerate sequential product IDs to read sensitive MQTT credentials, modify product configurations including tenant identifiers, or delete products along with related data.
LogChimp versions from 0.9.0-alpha.1 up to but not including 0.9.3 contain an authorization bypass vulnerability. This flaw allows authenticated post authors to modify posts they do not own by manipulating postId and id parameters in the request body. Exploitation enables attackers to overwrite critical post fields such as title, slug, content, boardId, and roadmap_id.
CVE-2026-65108 is a heap-based buffer overflow vulnerability in the slurmstepd process of NVIDIA Slurm. The flaw occurs when slurmstepd runs with root permissions and allows an attacker to control the overflow. This vulnerability has a CVSS score of 6.3, indicating a medium severity level. No affected versions or patch information are provided, and there are no known exploits in the wild.
GLPI versions 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contain a privilege escalation vulnerability. Authenticated users with the Technician profile can clone Super-Admin accounts, gaining elevated privileges without proper permission checks. This occurs because the cloning function copies all profile and group assignments indiscriminately.