CVEs.

Matching CVEs

1. 5.3Med

   CVE-2026-120820 ↗ (opens in a new tab)

   MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process.

   MAMongoDB Atlas· Nov 10, 2026

2. 5.3Med

   CVE-2026-120819 ↗ (opens in a new tab)

   A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.

   MAMongoDB Atlas· Nov 10, 2026

3. 6.0Med

   CVE-2026-120812 ↗ (opens in a new tab)

   An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process termination when processing certain queries against time-series collections.

   MAMongoDB Atlas· Nov 10, 2026

4. 6.0Med

   CVE-2026-120811 ↗ (opens in a new tab)

   A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.

   MAMongoDB Atlas· Nov 10, 2026

5. 6.1Med

   CVE-2026-120809 ↗ (opens in a new tab)

   A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engi

   MAMongoDB Atlas· Nov 10, 2026

6. 6.5Med

   CVE-2026-124194 ↗ (opens in a new tab)Known exploited

   Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

   M3Microsoft 365· Nov 10, 2026

7. 5.7Med

   CVE-2026-123082 ↗ (opens in a new tab)

   Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versi

   DODocker· Nov 10, 2026

8. 5.3Med

   CVE-2026-100962 ↗ (opens in a new tab)

   NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might cause information disclosure.

   NVNVIDIA· Nov 10, 2026

9. 5.3Med

   CVE-2026-87857 ↗ (opens in a new tab)

   Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read perm

   TCTemporal Cloud· Nov 9, 2026

10. 4.5Med

    CVE-2026-121520 ↗ (opens in a new tab)

    In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.

    DODocker· Nov 3, 2026

11. 5.3Med

    CVE-2026-118237 ↗ (opens in a new tab)

    An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerab

    GIGitHub· Nov 3, 2026

12. 5.3Med

    CVE-2026-110288 ↗ (opens in a new tab)

    A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuratio

    GIGitHub· Nov 3, 2026

13. 5.6Med

    CVE-2026-121541 ↗ (opens in a new tab)

    In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

    DODocker· Nov 3, 2026

14. 6.7Med

    CVE-2026-121522 ↗ (opens in a new tab)

    In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

    DODocker· Nov 3, 2026

15. 6.0Med

    CVE-2026-120952 ↗ (opens in a new tab)

    An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.

    MAMongoDB Atlas· Nov 3, 2026

16. 6.3Med

    CVE-2026-120954 ↗ (opens in a new tab)

    A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to pa

    MAMongoDB Atlas· Nov 3, 2026

17. 5.1Med

    CVE-2026-120953 ↗ (opens in a new tab)

    A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.

    MAMongoDB Atlas· Nov 3, 2026

18. 6.0Med

    CVE-2026-120684 ↗ (opens in a new tab)

    A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

    MAMongoDB Atlas· Nov 3, 2026

19. 6.8Med

    CVE-2026-120673 ↗ (opens in a new tab)

    A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

    MAMongoDB Atlas· Nov 3, 2026

20. 5.2Med

    CVE-2026-119675 ↗ (opens in a new tab)

    MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior.

    MAMongoDB Atlas· Nov 3, 2026

21. 5.9Med

    CVE-2026-119672 ↗ (opens in a new tab)

    MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to

    MAMongoDB Atlas· Nov 3, 2026

22. 6.5Med

    CVE-2026-115716 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.

    ECElastic Cloud· Nov 3, 2026

23. 6.5Med

    CVE-2026-115715 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.

    ECElastic Cloud· Nov 3, 2026

24. 4.2Med

    CVE-2026-115710 ↗ (opens in a new tab)

    Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the sam

    ECElastic Cloud· Nov 3, 2026

25. 4.3Med

    CVE-2026-115298 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.

    ECElastic Cloud· Nov 3, 2026

26. 6.5Med

    CVE-2026-115297 ↗ (opens in a new tab)

    NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.

    ECElastic Cloud· Nov 3, 2026

27. 4.3Med

    CVE-2026-115295 ↗ (opens in a new tab)

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.

    ECElastic Cloud· Nov 3, 2026

28. 6.5Med

    CVE-2026-115293 ↗ (opens in a new tab)

    Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.

    ECElastic Cloud· Nov 3, 2026

29. 4.3Med

    CVE-2026-115292 ↗ (opens in a new tab)

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.

    ECElastic Cloud· Nov 3, 2026

30. 4.3Med

    CVE-2026-115289 ↗ (opens in a new tab)

    Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.

    ECElastic Cloud· Nov 3, 2026

31. 5.3Med

    CVE-2026-65165 ↗ (opens in a new tab)

    NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.

    NVNVIDIA· Nov 3, 2026

32. 5.7Med

    CVE-2026-65140 ↗ (opens in a new tab)

    NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.

    NVNVIDIA· Nov 3, 2026

33. 6.3Med

    CVE-2026-65139 ↗ (opens in a new tab)

    NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.

    NVNVIDIA· Nov 3, 2026

34. 6.3Med

    CVE-2026-65138 ↗ (opens in a new tab)

    NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.

    NVNVIDIA· Nov 3, 2026

35. 4.7Med

    CVE-2026-65109 ↗ (opens in a new tab)

    NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node.

    NVNVIDIA· Nov 3, 2026

36. 6.3Med

    CVE-2026-65108 ↗ (opens in a new tab)

    NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.

    NVNVIDIA· Nov 3, 2026

37. 6.3Med

    CVE-2026-65107 ↗ (opens in a new tab)

    NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.

    NVNVIDIA· Nov 3, 2026

38. 5.5Med

    CVE-2026-65160 ↗ (opens in a new tab)

    NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.

    NVNVIDIA· Nov 3, 2026

39. 4.3Med

    CVE-2026-102260 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

40. 4.3Med

    CVE-2026-115712 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.

    ECElastic Cloud· Oct 29, 2026

41. 6.4Med

    CVE-2026-115711 ↗ (opens in a new tab)

    Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installat

    ECElastic Cloud· Oct 29, 2026

42. 6.4Med

    CVE-2026-115707 ↗ (opens in a new tab)

    Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages.

    ECElastic Cloud· Oct 29, 2026

43. 6.8Med

    CVE-2026-115706 ↗ (opens in a new tab)

    Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.

    ECElastic Cloud· Oct 29, 2026

44. 6.0Med

    CVE-2026-79656 ↗ (opens in a new tab)

    A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

    GCGrafana Cloud· Oct 28, 2026

45. 6.5Med

    CVE-2026-88858 ↗ (opens in a new tab)

    A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

    GCGrafana Cloud· Oct 28, 2026

46. 6.9Med

    CVE-2026-118581 ↗ (opens in a new tab)

    A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to i

    MAMongoDB Atlas· Oct 28, 2026

47. 6.5Med

    CVE-2026-16491 ↗ (opens in a new tab)

    Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

    GCGrafana Cloud· Oct 27, 2026

48. 5.7Med

    CVE-2026-114409 ↗ (opens in a new tab)

    Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

    DODocker· Oct 27, 2026

49. 5.1Med

    CVE-2026-86990 ↗ (opens in a new tab)

    An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. A malicious app may be able to access the camera without user permission.

    APApple (iCloud, App Store and services)· Oct 26, 2026

50. 5.1Med

    CVE-2026-86989 ↗ (opens in a new tab)

    An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.

    APApple (iCloud, App Store and services)· Oct 26, 2026