CVEs.

Matching CVEs

1. 7.8High

   CVE-2026-65178 ↗ (opens in a new tab)

   NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

   NVNVIDIA· Sep 22, 2026

2. 8.3High

   CVE-2026-65129 ↗ (opens in a new tab)

   NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

   NVNVIDIA· Sep 22, 2026

3. 8.8High

   CVE-2026-65128 ↗ (opens in a new tab)

   NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

   NVNVIDIA· Sep 22, 2026

4. 8.8High

   CVE-2026-65126 ↗ (opens in a new tab)

   NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

   NVNVIDIA· Sep 22, 2026

5. 8.8High

   CVE-2026-65125 ↗ (opens in a new tab)

   NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.

   NVNVIDIA· Sep 22, 2026

6. 8.1High

   CVE-2026-65124 ↗ (opens in a new tab)

   NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service.

   NVNVIDIA· Sep 22, 2026

7. 8.8High

   CVE-2026-65117 ↗ (opens in a new tab)

   NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

   NVNVIDIA· Sep 22, 2026

8. 7.8High

   CVE-2026-65111 ↗ (opens in a new tab)

   NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

   NVNVIDIA· Sep 22, 2026

9. 7.8High

   CVE-2026-24267 ↗ (opens in a new tab)

   NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

   NVNVIDIA· Sep 22, 2026

10. 7.8High

    CVE-2026-24239 ↗ (opens in a new tab)

    NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

    NVNVIDIA· Sep 22, 2026

11. 8.7High

    CVE-2026-89139 ↗ (opens in a new tab)

    Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller's request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a c

    TCTemporal Cloud· Sep 21, 2026

12. 7.2High

    CVE-2026-87858 ↗ (opens in a new tab)

    Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving th

    TCTemporal Cloud· Sep 21, 2026

13. 8.7High

    CVE-2026-65654 ↗ (opens in a new tab)

    github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses containing label keys, values, or counts that exceed the receiver's configured limits. Accepted labels are retained in the member list and disseminated to peers, allowing memory and gossip-bandwidth consumption to exceed configured bounds and potential

    TCTemporal Cloud· Sep 21, 2026

14. 8.7High

    CVE-2026-65653 ↗ (opens in a new tab)

    github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against app

    TCTemporal Cloud· Sep 21, 2026

15. 8.7High

    CVE-2026-65652 ↗ (opens in a new tab)

    github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiali

    TCTemporal Cloud· Sep 21, 2026

16. 8.7High

    CVE-2026-65651 ↗ (opens in a new tab)

    temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query

    TCTemporal Cloud· Sep 21, 2026

17. 7.1High

    CVE-2026-16652 ↗ (opens in a new tab)

    Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without addit

    TCTemporal Cloud· Sep 21, 2026

18. 8.7High

    CVE-2026-16651 ↗ (opens in a new tab)

    temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permiss

    TCTemporal Cloud· Sep 21, 2026

19. 7.1High

    CVE-2026-93764 ↗ (opens in a new tab)

    Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.

    MAMongoDB Atlas· Sep 18, 2026

20. 7.1High

    CVE-2026-93763 ↗ (opens in a new tab)

    A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.

    MAMongoDB Atlas· Sep 18, 2026

21. 8.7High

    CVE-2026-93761 ↗ (opens in a new tab)

    An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.

    MAMongoDB Atlas· Sep 18, 2026

22. 8.3High

    CVE-2026-93760 ↗ (opens in a new tab)

    Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.

    MAMongoDB Atlas· Sep 18, 2026

23. 8.8High

    CVE-2026-93759 ↗ (opens in a new tab)

    Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.

    MAMongoDB Atlas· Sep 18, 2026

24. 8.3High

    CVE-2026-93765 ↗ (opens in a new tab)

    Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.

    MAMongoDB Atlas· Sep 18, 2026

25. 8.6High

    CVE-2026-93758 ↗ (opens in a new tab)

    An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

    MAMongoDB Atlas· Sep 18, 2026

26. 7.5High

    CVE-2026-68791 ↗ (opens in a new tab)

    Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.

    MAMicrosoft Azure· Sep 17, 2026

27. 7.3High

    CVE-2026-76154 ↗ (opens in a new tab)

    A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

    GCGrafana Cloud· Sep 17, 2026

28. 8.8High

    CVE-2026-15815 ↗ (opens in a new tab)

    Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution. Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that

    GCGrafana Cloud· Sep 17, 2026

29. 8.5High

    CVE-2026-79708 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles, due to insufficient scope validation.

    GIGitLab· Sep 16, 2026

30. 7.5High

    CVE-2026-1168 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

    GIGitLab· Sep 16, 2026

31. 7.5High

    CVE-2025-14871 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

    GIGitLab· Sep 16, 2026

32. 8.7High

    CVE-2026-79994 ↗ (opens in a new tab)

    The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.

    DODocker· Sep 15, 2026

33. 8.5High

    CVE-2026-88765 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.

    GIGitLab· Sep 15, 2026

34. 7.7High

    CVE-2026-13210 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher.

    GIGitLab· Sep 15, 2026

35. 7.1High

    CVE-2026-8821 ↗ (opens in a new tab)

    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field.. Mattermost Advisory ID: MMSA-2026-00677

    MCMattermost Cloud· Sep 14, 2026

36. 8.5High

    CVE-2026-20773 ↗ (opens in a new tab)

    A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

    PIPing Identity· Sep 14, 2026

37. 7.8High

    CVE-2026-90894 ↗ (opens in a new tab)

    Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

    JFJFrog· Sep 14, 2026

38. 7.7High

    CVE-2026-89099 ↗ (opens in a new tab)

    A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.

    MAMongoDB Atlas· Sep 11, 2026

39. 8.2High

    CVE-2026-88032 ↗ (opens in a new tab)

    A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

    MAMongoDB Atlas· Sep 10, 2026

40. 7.1High

    CVE-2026-88021 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

41. 7.7High

    CVE-2026-87993 ↗ (opens in a new tab)

    The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

42. 8.3High

    CVE-2026-87090 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

43. 7.1High

    CVE-2026-88028 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target.

    MAMongoDB Atlas· Sep 10, 2026

44. 7.1High

    CVE-2026-88027 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

45. 7.1High

    CVE-2026-88026 ↗ (opens in a new tab)

    Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

    MAMongoDB Atlas· Sep 10, 2026

46. 8.4High

    CVE-2026-88022 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.

    MAMongoDB Atlas· Sep 10, 2026

47. 8.6High

    CVE-2026-85217 ↗ (opens in a new tab)

    A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy, potentially exposing sensitive information with the current user.

    AUAutodesk· Sep 10, 2026

48. 7.2High

    CVE-2026-0310 ↗ (opens in a new tab)

    A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blog

    PAPalo Alto Networks· Sep 10, 2026

49. 7.4High

    CVE-2026-84003 ↗ (opens in a new tab)

    Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.

    MAMicrosoft Azure· Sep 8, 2026

50. 7.8High

    CVE-2026-81960 ↗ (opens in a new tab)

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Sep 8, 2026