Data Management and Analytics

In Kibana all versions from 8.0.0 up to and including 8.19.12, all versions from 9.0.0 up to and including 9.2.6, all versions from 9.3.0 up to and including 9.3.1 a medium severity vulnerability CVE-2026-26940 was detected. This vulnerability allows an authenticated user to send a specially crafted Timelion expression with an excessively large quantity value, causing internal series data properties to be overwritten and resulting in a Denial of Service via excessive resource allocation. To address this issue, users should upgrade Kibana to versions 8.19.13, 9.2.7 or 9.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26940.

In Kibana all versions from 8.0.0 up to and including 8.19.11, all versions from 9.0.0 up to and including 9.2.5, and version 9.3.0 a high severity vulnerability CVE-2026-26939 was detected. This vulnerability allows an authenticated attacker with rule management privileges to bypass server-side authorization in the Detection Rule Management system, enabling unauthorized configuration of endpoint response actions such as host isolation, process termination, and process suspension. To address this issue, users should upgrade Kibana to versions 8.19.12, 9.2.6 or 9.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26939.

In Jenkins versions 2.550 and earlier, including LTS 2.541.1 and earlier a medium severity vulnerability CVE-2026-27100 was detected. This vulnerability allows attackers with Item/Build and Item/Configure permissions to submit Run Parameter values referencing builds they do not have access to, thereby disclosing information about the existence of jobs, builds, and build display names. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27100.

In Graylog version 2.2.3 a medium severity vulnerability CVE-2026-1438 was detected. This vulnerability allows attackers to inject and execute arbitrary JavaScript code in a victim’s browser via a reflected Cross-Site Scripting (XSS) flaw in the Web Interface console due to improper sanitization and escaping of URL segments in the ‘/system/nodes/’ endpoint. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1438.

In Graylog version 2.2.3, a medium severity vulnerability CVE-2026-1437 was detected. This vulnerability allows attackers to inject and execute arbitrary JavaScript code in a victim’s browser via a reflected Cross-Site Scripting (XSS) flaw in the Web Interface console due to improper sanitization and escaping of URL segments in the ‘/system/authentication/users/edit/’ endpoint. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1437.

In Graylog version 2.2.3 a high severity vulnerability CVE-2026-1436 was detected. This vulnerability allows authenticated users to access other users’ profiles without proper authorization due to an Insecure Direct Object Reference (IDOR) flaw in the API when modifying the user ID in the URL. Exploitation of this issue may expose sensitive information such as names, email addresses, internal identifiers, and last activity. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1436.

In Graylog version 2.2.3 a critical severity vulnerability CVE-2026-1435 was detected. This vulnerability allows an attacker to reuse previously issued session identifiers because the application does not properly invalidate old sessions after new logins. Exploitation of this issue may enable unauthorized access to the application, allowing interaction with the API or web interface and potential compromise of affected accounts. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1435.

In PostgreSQL versions 18.0 and 18.1 a high severity vulnerability CVE-2026-2007 was detected. This vulnerability allows a database user to trigger a heap buffer overflow via a crafted input string in the pg_trgm extension, which may lead to privilege escalation or other unintended impacts due to improper memory handling. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2007.