CVE-2026-4819

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522CWE-532

Affected software

VendorProductVersions
floragunnSearch Guard FLX>= 1.0.0, <= 4.0.1

References

Timeline

Published
Mar 31, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-481903.5An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query theCVE-2026-481913.5An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules alCVE-2026-481925.4A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.CVE-2026-481938.1Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.CVE-2026-481948.1Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.CVE-2026-481956.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows CVE-2026-481966.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allowsCVE-2026-481977.2Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege EscalatiCVE-2026-481997.5Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.CVE-2026-48204.3IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. AttackerCVE-2026-482005.3Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows RetrieveCVE-2026-482017.1Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
CVE-2026-4819: Medium severity, CVSS 6.5 | Vulnix