PULSEUnderground Intel

EN VIVO20señales / 24h

FEED

ransomwallstreet reclama a Prism Medical Products · US · Healthcareransomn0n reclama a PROTEX Confection · TN · Manufacturingransomn0n reclama a SunTechnics Fabrisolar AG · CH · Energy & Utilitiesransomemperador reclama a B2Chat · Technologyransomqilin reclama a Coop Italia · IT · Retail & E-Commerceransomqilin reclama a SEPIVER · MX · Not Foundransomlockbit5 reclama a istanbultrading.com · TR · Retail & E-Commerceransomsilentransomgroup reclama a M... C... · Not Foundransomqilin reclama a United Restaurant Supply · US · Hospitalityransombravox reclama a AMSAM · FR · Not Foundransombravox reclama a Barrow & Grimm · US · Not Foundransomsilentransomgroup reclama a M...r · Not Foundransomsilentransomgroup reclama a Kirkland & Ellis LLP · US · Professional Servicesransomakira reclama a Bethany Press International · Retail & E-Commerceransomwallstreet reclama a Prism Medical Products · US · Healthcareransomn0n reclama a PROTEX Confection · TN · Manufacturingransomn0n reclama a SunTechnics Fabrisolar AG · CH · Energy & Utilitiesransomemperador reclama a B2Chat · Technologyransomqilin reclama a Coop Italia · IT · Retail & E-Commerceransomqilin reclama a SEPIVER · MX · Not Foundransomlockbit5 reclama a istanbultrading.com · TR · Retail & E-Commerceransomsilentransomgroup reclama a M... C... · Not Foundransomqilin reclama a United Restaurant Supply · US · Hospitalityransombravox reclama a AMSAM · FR · Not Foundransombravox reclama a Barrow & Grimm · US · Not Foundransomsilentransomgroup reclama a M...r · Not Foundransomsilentransomgroup reclama a Kirkland & Ellis LLP · US · Professional Servicesransomakira reclama a Bethany Press International · Retail & E-Commerce

← Todos los CVEs

CVE Watch9 oct 2026

CVE-2026-102410

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (C

CVSS

4.3

Medio

EPSS

0.2%

p10

KEV

—

Exploit Today

3

0-100

Publicado: 6 oct 2026 · Última mod.: 9 oct 2026 · CWE-862

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-10-072026-10-22

Descripción técnica

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.

Referencias oficiales

discuss.elastic.cohttps://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1145156.5 MED

——0OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.23h CVE-2026-1153237.3 ALT

——0EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.1d CVE-2026-1128426.5 MED

——0Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.23h CVE-2026-1146995.3 MED

——2Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.23h CVE-2026-1146965.3 MED

——2Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.23h CVE-2026-1123127.5 ALT

——4Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.23h