Out-of-bounds read in Samsung's rlottie animation library (not Escargot as the CVE metadata incorrectly states) exposes consumers of the library - including Samsung TV appliances - to information disclosure and potential parser crashes when processing specially crafted JPEG images. The root cause is the absence of fractional-ratio validation in stb_image.h's JPEG frame header processor: when h_max is not evenly divisible by a color component's sampling factor, the resampler accesses memory beyond the intended buffer boundary. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Incorrect Authorization (CWE-863) in Kibana allows a low-privileged authenticated user to exploit misconfigured access control levels, resulting in partial denial of service against the Kibana instance. Affected across Kibana 8.x and 9.x branches, with fixes released in versions 8.19.21, 9.4.6, and 9.5.3 per Elastic advisory ESA-2026-174. No public exploit code or active exploitation has been identified at time of analysis.
Log injection in IBM Netezza Software 11.3.0.3 through Interim Fix 002 allows unauthenticated remote attackers to insert arbitrary content into log files by supplying input containing special characters - such as CRLF sequences - that is written to logs without proper neutralization. The vulnerability (CWE-117) enables falsification of audit trails, potential SIEM-alert manipulation, and degradation of forensic fidelity. No public exploit code or active exploitation has been identified; a vendor patch is available via IBM Support.
Template injection in Kibana's Cribl integration allows a low-privileged authenticated user holding Fleet management rights to write Elasticsearch ingest pipelines exceeding their authorized Elasticsearch permissions. The flaw stems from insufficient validation of a configuration field that is rendered server-side as a script template, giving the attacker a code injection foothold (CWE-94) into the pipeline generation path. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L/I:L) reflects the constrained privilege requirement and limited integrity impact.
Cross-space agent data exposure in the Kibana Fleet feature allows authenticated low-privileged users to read agent metadata and diagnostic content outside their authorized Kibana space. An attacker holding read-level Fleet agent privileges in any one Kibana space can enumerate agents enrolled in other spaces - bypassing the space-based access boundary that Elastic uses for multi-tenancy isolation. No public exploit or active exploitation has been identified; CVSS 4.3 with PR:L aligns with the real-world impact: meaningful tenant boundary breach, but limited to read-only metadata disclosure.
Privilege abuse in Kibana allows an authenticated user holding Security read-level access in a single Kibana space to trigger Entity Analytics migration operations that perform write actions across all Kibana spaces, violating the platform's space-isolation access control model. The vulnerability stems from CWE-862 (Missing Authorization): the migration API endpoint executes privileged writes without verifying whether the caller's authorization scope covers the target spaces. No public exploit has been identified at time of analysis; a vendor patch is available per ESA-2026-154.
Server-Side Request Forgery in Dell PowerProtect Data Manager's REST API (versions 20.2.0.0 and below) allows high-privileged remote attackers to induce the server to issue unauthorized outbound HTTP requests to internal or adjacent network resources. The CVSS scope-change metric (S:C) signals that successful exploitation can reach infrastructure beyond the PowerProtect instance itself, enabling partial internal-network reconnaissance even from a single compromised admin session. No public exploit code exists and no active exploitation has been confirmed; Dell has issued multi-vulnerability advisory DSA-2026-368 addressing this flaw.
Privilege escalation in an Ubuntu-packaged application allows an operator-level authenticated user to modify Administrator accounts by exploiting insufficient authorization controls in the accounting database layer. The exact affected product is not determinable from available data - the description appears to be a commit-message-style changelog entry rather than a formal CVE description. No patch version, CPE string, CVSS score, or CWE identifier has been assigned, severely limiting independent verification. No public exploit has been identified at time of analysis.
CVE-2026-65165 describes unspecified issues in job step handling and node count tracking, reported via the Ubuntu vendor channel. The description '[Fix various issues around job steps and node count discrepancies]' reads as a commit message rather than a structured vulnerability disclosure, providing almost no actionable security detail. Without CVSS metrics, CWE classification, or references, the security impact - whether denial of service, privilege escalation, or incorrect resource allocation - cannot be determined from available data.
Stack-based buffer overflow in slurmstepd, the SLURM job step daemon, can be triggered by an authenticated cluster user who submits a job containing an oversized SPANK (SLURM Plug-in Architecture for Node and job Control) option variable in the job environment. Because slurmstepd typically executes with elevated privileges on compute nodes, successful exploitation could allow a regular SLURM user to achieve privilege escalation or arbitrary code execution on cluster nodes. No public exploit or CISA KEV listing has been identified at time of analysis; this report originates from Ubuntu's vendor security tracking.
Multiple unsafe database operations and query-construction flaws in slurmdbd, the SLURM Workload Manager's accounting database daemon, allow authenticated cluster users or malicious slurmctld nodes to send crafted requests that result in unvalidated or improperly sanitized queries against the underlying database. The precise impact - whether SQL injection, privilege escalation within Slurm accounting, or data corruption - is not fully disclosed in available sources. No CVSS score, CWE classification, or KEV listing is present at time of analysis; the vulnerability is known only through an Ubuntu vendor disclosure.
Credential verification bypass in Slurm's sbcast facility allows broadcast of shared objects (.so files) to job-allocated nodes without proper authentication checks, potentially enabling library injection across compute nodes. A second concurrent flaw permits invalid sbcast filenames to crash the slurmd daemon, causing a denial of service on affected compute nodes. Both issues affect Slurm HPC workload manager environments where sbcast is used; the credential bypass carries the higher severity given its potential for integrity compromise across cluster nodes.
Path traversal during OCI container cleanup in Slurm's slurmstepd daemon allows files outside the designated container spool directory to be deleted on the host compute node. Affected clusters are those using Slurm's OCI container support; the bug manifests during job-step teardown, meaning any cluster user who can submit OCI-containerized jobs can trigger deletion of arbitrary files on the compute node. A secondary issue causes spool directories to be orphaned when ContainerPath includes a task ID pattern, resulting in disk resource leakage. No vendor CVSS score is published; exploitation conditions require a valid cluster account and OCI container feature enablement. No public exploit code has been identified at time of analysis.
Heap over-read and crash vulnerabilities in Slurm's slurmd compute-node daemon expose HPC clusters to memory disclosure and denial of service. When slurmd receives a malformed forward data RPC, insufficient input validation allows an attacker to trigger a heap over-read during message unpacking or crash the daemon outright if the RPC lacks a required socket address. The primary impact is availability loss on affected compute nodes; the heap over-read additionally carries a low-severity information disclosure risk. No public exploit code has been identified at time of analysis.