CVE Vulnerability Catalog

In Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

The async-tar library for async Rust before version 0.6.1 mis-applies a buffered PAX size extension to an intermediary extension header (GNU longname L, GNU longlink K, or PAX x/g) instead of to the next file entry. This desynchronizes the parser relative to a POSIX-correct tar parser (e.g., GNU tar), reading subsequent bytes at the wrong block boundary.

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 lacks CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privileged user edits the post.

Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.

Incorrect Authorization in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized data modification via Metadata Spoofing. An actor with limited Kubernetes permissions in a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.

Path Traversal vulnerability in Elastic Maps Server can lead to information disclosure. An unauthenticated attacker able to reach the service over the network could cause it to return contents of files outside its intended content directory that are readable by the server process.

Missing Authorization in Kibana for an Entity Store configuration operation allows an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices the user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

Path Traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of internal resources. A low-privileged user with Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.

Incorrect Authorization in the Kibana machine learning feature can lead to information disclosure. An authenticated user with ML job management privileges in a single Kibana space could cause a job's saved object to become accessible across all spaces, without holding access rights to those additional spaces.

Improper handling of highly compressed data in APM Server can lead to persistent denial of service. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts memory when processed, terminating the process. The condition recurs on every restart until the stored content is removed.

Path Traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of resources. A low-privileged user could cause a subsequent action by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in deletion of resources including accounts with elevated privileges.

Unrestricted resource allocation in Filebeat can lead to denial of service. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.

Unrestricted resource allocation in Kibana can lead to denial of service. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.

Observable response discrepancy in the Kibana Osquery feature can lead to information disclosure. An authenticated user with Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.