CVE-2026-82641

Keploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Keploy

Products

Keploy

CVE-2026-82463

pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Pac4j

Products

Pac4j

CVE-2026-59285

Spring for GraphQL Unsafe Deserialization in pagination support

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring For Graphql Spring For Graphql

CVE-2026-54789

mod_auth_openidc has out-of-bounds read and write in state cookie parsing

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Openidc

Products

Mod Auth Openidc

CVE-2026-38345

ffmpeg: FFmpeg: Denial of Service via division-by-zero vulnerability in `ff_sws_init_single_context` function.

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-37236

github.com/grpc-ecosystem/grpc-gateway: grpc-gateway: Access control bypass via X-HTTP-Method-Override header

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Grpc-ecosystem

Products

Grpc-gateway

CVE-2026-78676

GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-78677

GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-12878

Codefresh: Codefresh: Privilege Escalation via API Endpoint

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Linux Microsoft Octopus and 1 more

Products

Linux Kernel Windows Codefresh and 1 more

CVE-2026-18544

Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Portieris

CVE-2026-18849

IBM OpenBMC Code Execution

IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Openbmc Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware and 14 more

CVE-2026-18295

GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2026-18296

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29608.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2026-78597

Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-78607

Missing Authorization in Elasticsearch Leading to Information Disclosure

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-78605

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-72654

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather than the identity of the requesting user. Such a user could therefore receive data from Elasticsearch indices they are not authorized to read. No Elasticsearch cluster or index privileges are required.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72649

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-49096

Uncaught Exception in Kibana Cases Leading to Denial of Service

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-72630

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation

Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana