Uncontrolled Resource Consumption in Elasticsearch Causes Denial

🔓 VULNERABILITIES & CVEs

• Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVE-2026-63263) — CVSS 6.5
  Elasticsearch is vulnerable to uncontrolled resource consumption that can cause denial of service conditions.

  • detail: CVSS 6.5 severity rating.

• Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVE-2026-63261) — CVSS 6.5
  Kibana suffers from similar uncontrolled resource consumption issues that can trigger denial of service.

  • detail: CVSS 6.5 severity rating.

• Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVE-2026-63260) — CVSS 6.5
  Another denial of service vulnerability in Kibana due to uncontrolled resource consumption.

  • detail: CVSS 6.5 severity rating.

• Missing Authorization in Kibana Leading to Information Disclosure (CVE-2026-63262) — CVSS 4.3
  Kibana has missing authorization checks that allow unauthorized information disclosure.

  • detail: CVSS 4.3 severity rating.

• Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure (CVE-2026-63259) — CVSS 4.3
  User-controlled keys can bypass authorization in Kibana, exposing sensitive information.

  • detail: CVSS 4.3 severity rating.

• Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Issues (CVE-2026-63145) — CVSS 4.3
  Authorization flaws in Kibana affect the integrity of machine learning audit logs.

  • detail: CVSS 4.3 severity rating.

• jsforce SFDX Connection Registry sfdx.js execCommand OS Command Injection (CVE-2026-16489) — CVSS 5.3
  OS command injection vulnerability in jsforce's SFDX connection registry.

  • detail: CVSS 5.3 severity rating.

• QUSETIONS MiniCode-Python Project File config.py subprocess.Popen OS Command Injection (CVE-2026-16488) — CVSS 5.0
  OS command injection via subprocess.Popen in MiniCode-Python project configuration.

  • detail: CVSS 5.0 severity rating.

• SourceCodester Class and Exam Timetabling System BSIS.php Cross Site Scripting (CVE-2026-16486) — CVSS 4.3
  Cross-site scripting vulnerability in SourceCodester Class and Exam Timetabling System.

  • detail: CVSS 4.3 severity rating.

• Libarchive Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517) — CVSS 2.9
  Signed integer overflow in libarchive's ZIP header writing function.

  • detail: CVSS 2.9 severity rating.

• Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVE-2026-63144)
  Elasticsearch vulnerable to denial of service via uncontrolled recursion.

• Netty Missing CertificateID Validation in OCSP Response Allows Replay Attack (CVE-2026-56820)
  Netty's OCSP response handling lacks certificate ID validation, enabling replay attacks.