Archive
21 July 2026
Vulnerabilities first published on this day (UTC), newest first.
441 results · Clear filters · Feed
-
Medium 5.3
jsforce SFDX Connection Registry sfdx.js _execCommand os command injection
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be perform…
-
Medium 5.0
QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection
A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The at…
-
Medium 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption durin…
-
Medium 4.3
Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.
-
Medium 6.5
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exha…
-
Medium 6.5
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, o…
-
Medium 4.3
SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exp…
-
Medium 4.3
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.
-
Medium 4.3
Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise
Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functio…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive…
-
Medium 4.3
Missing Authorization in Kibana Leading to Unauthorized Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to…
-
Medium 5.0
Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network…
-
Medium 5.4
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote atta…
-
Medium 4.3
SourceCodester Class and Exam Timetabling System class.php cross site scripting
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launche…
-
Medium 5.4
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Suppor…
-
Medium 6.5
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.8
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.5
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.3
Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self Service Benefits). Su…
-
Medium 6.3
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supp…
-
Medium 6.3
Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Suppor…
-
Medium 6.3
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported v…
-
Medium 6.3
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality Workbench HTML system). Supp…
-
Medium 6.3
Vulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component: Succession plan). Suppor…
-
Medium 5.3
Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 5.3
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Medium 6.7
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Medium 6.1
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Medium 5.3
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 4.2
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 6.5
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 5.0
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 5.9
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 6.1
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 4.3
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supp…
-
Medium 5.4
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Medium 6.5
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Medium 5.4
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Medium 6.3
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Lease Authoring…
-
Medium 6.5
Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Manager Self-Se…