rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-26746 
OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-20T00:00:00.000Z
CVE-2026-26747 
A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-20T00:00:00.000Z
CVE-2026-26791 
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-26792 
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbitrary commands via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-26793 
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-26794 
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-26795 
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-26801 
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2026-26824 
libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-26825 
A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-26828 
A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-23T00:00:00.000Z
CVE-2026-26829 
A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Denial of Service (DoS) via sending a series of crafted HTTP requests to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-23T00:00:00.000Z
CVE-2026-26830 
pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2026-03-25T00:00:00.000Z
CVE-2026-26831 
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-25T00:00:00.000Z
CVE-2026-26832 
node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2026-03-25T00:00:00.000Z
CVE-2026-26833 
thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-25T00:00:00.000Z
CVE-2026-26861 
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-27T00:00:00.000Z
CVE-2026-26862 
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method to verify the originUrl contains "dashboard.clevertap.com", which can be bypassed by an attacker using a crafted subdomain
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-27T00:00:00.000Z
CVE-2026-26883 
Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/classes/Master.php?f=delete_appointment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26884 
Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/admin/appointments/view_appointment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26885 
Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /classes/Master.php?f=delete_service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26886 
Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /admin/services/manage_service.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26887 
Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_supplier.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26888 
Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_stock.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26889 
Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26890 
Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26891 
Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage_parcel_type.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26892 
Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage_carrier.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2026-26895 
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-02T00:00:00.000Z
CVE-2026-26927 URL (HTTP Origin) call location spoofing in Szafir SDK Web
Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched.
In Szafir SDK Web it is possible to change the URL (HTTP Origin) of the application call location. An unauthenticated attacker can craft a website that is able to launch SzafirHost application with arbitrary arguments via Szafir SDK Web browser addon. No validation will be performed to check whether the address specified in `document_base_url` parameter is in any way related to the actual address of the calling web application. The URL address specified in `document_base_url` parameter is then shown in the application confirmation prompt. When a victim confirms the execution of the application, it will be called in the context of attacker's website URL and might download additional files and libraries from that website. When victim accepts the application execution for the URL showed in the confirmation prompt with the "remember" option before, the prompt won't be shown and the application will be called in the context of URL provided by the attacker without any interaction.

This issue was fixed in version 0.0.17.4.
Problem types: cwe_id: CWE-348
description: CWE-348 Use of Less Trusted Source
Affected products: vendor: Krajowa Izba Rozliczeniowa
product: Szafir SDK Web
default_status: unaffected
Credits: lang: en
value: Michał Leszczyński
Published: 2026-04-02T14:01:39.075Z
CVE-2026-26928 Lack of Dynamic Library Validation in SzafirHost
SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application.

This issue was fixed in version 1.1.0.
Problem types: cwe_id: CWE-354
description: CWE-354 Improper Validation of Integrity Check Value
Affected products: vendor: Krajowa Izba Rozliczeniowa
product: SzafirHost
default_status: unaffected
Credits: lang: en
value: Michał Leszczyński
Published: 2026-04-02T14:01:42.262Z
CVE-2026-26929 Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.


Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
default_status: unaffected
Credits: lang: en
value: Pierre Jeambrun
Published: 2026-03-17T10:54:05.523Z
CVE-2026-26930 
SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: SmarterTools
product: SmarterMail
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-02-16T16:27:14.946Z
CVE-2026-26931 Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service
Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
Problem types: cwe_id: CWE-789
description: CWE-789 Memory Allocation with Excessive Size Value
Affected products: vendor: Elastic
product: Metricbeat
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.7
confidentialityImpact: NONE
integrityImpact: NONE
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: LOW
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-19T17:05:57.514Z
CVE-2026-26932 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.
Problem types: cwe_id: CWE-129
description: CWE-129 Improper Validation of Array Index
Affected products: vendor: Elastic
product: Packetbeat
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.7
confidentialityImpact: NONE
integrityImpact: NONE
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: LOW
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: giant_anteater
Published: 2026-02-26T16:59:55.310Z
CVE-2026-26933 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
Problem types: cwe_id: CWE-129
description: CWE-129 Improper Validation of Array Index
Affected products: vendor: Elastic
product: Packetbeat
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.7
confidentialityImpact: NONE
integrityImpact: NONE
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: LOW
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-19T17:08:45.745Z
CVE-2026-26934 Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.5
confidentialityImpact: NONE
integrityImpact: NONE
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-26T17:03:17.242Z
CVE-2026-26935 Improper Input Validation in Kibana Leading to Denial of Service
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.5
confidentialityImpact: NONE
integrityImpact: NONE
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-26T17:05:16.619Z
CVE-2026-26936 Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service
Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 4.9
confidentialityImpact: NONE
integrityImpact: NONE
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-26T17:07:40.604Z
CVE-2026-26937 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.5
confidentialityImpact: NONE
integrityImpact: NONE
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-26T17:51:35.421Z
CVE-2026-26938 Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
Problem types: cwe_id: CWE-1336
description: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.6
confidentialityImpact: HIGH
integrityImpact: NONE
scope: CHANGED
userInteraction: NONE
privilegesRequired: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2026-02-26T17:56:48.611Z
CVE-2026-26939 Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
confidentialityImpact: NONE
integrityImpact: HIGH
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2026-03-19T17:11:16.507Z
CVE-2026-26940 Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: Elastic
product: Kibana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.5
confidentialityImpact: NONE
integrityImpact: NONE
scope: UNCHANGED
userInteraction: NONE
privilegesRequired: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-19T17:14:31.734Z