Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115295 | medium | 4.3 | No | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Prop... | 2026-11-03 |
| CVE-2026-115294 | high | 7.3 | No | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion... | 2026-11-03 |
| CVE-2026-115293 | medium | 6.5 | No | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials tha... | 2026-11-03 |
| CVE-2026-115292 | medium | 4.3 | No | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Funct... | 2026-11-03 |
| CVE-2026-115290 | high | 7.5 | No | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An una... | 2026-11-03 |
| CVE-2026-115289 | medium | 4.3 | No | Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent... | 2026-11-03 |
| CVE-2026-109594 | medium | 6.8 | No | Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified i... | 2026-11-03 |
| CVE-2026-109593 | critical | 9.1 | No | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, pote... | 2026-11-03 |
| CVE-2026-103916 | not reported | — | No | Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace... | 2026-11-03 |
| CVE-2026-63470 | not reported | — | No | fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a gener... | 2026-11-03 |
| CVE-2026-63469 | not reported | — | No | fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-... | 2026-11-03 |
| CVE-2026-95777 | low | 3.1 | No | A sensitive information disclosure vulnerability exists in the management interface of HPE Networking Fabric Composer. Successful exploitati... | 2026-11-03 |
| CVE-2026-95776 | low | 3.1 | No | An authenticated path traversal vulnerability exists in the API of HPE Networking Fabric Composer, which could be exploited by an authentica... | 2026-11-03 |
| CVE-2026-95775 | low | 3.3 | No | A local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploit... | 2026-11-03 |
| CVE-2026-95774 | low | 3.7 | No | A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenti... | 2026-11-03 |
| CVE-2026-95773 | low | 3.8 | No | A denial-of-service vulnerability has been identified in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could... | 2026-11-03 |
| CVE-2026-95772 | medium | 4.2 | No | A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated att... | 2026-11-03 |
| CVE-2026-95771 | medium | 4.3 | No | An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation c... | 2026-11-03 |
| CVE-2026-95770 | medium | 4.7 | No | A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authent... | 2026-11-03 |
| CVE-2026-95769 | medium | 5.3 | No | An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthentica... | 2026-11-03 |