CVEs.

Matching CVEs

1. 6.8Med

   CVE-2026-12704 ↗ (opens in a new tab)

   When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

   GCGrafana Cloud· Sep 2, 2026

2. 4.3Med

   CVE-2026-82293 ↗ (opens in a new tab)

   Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.

   ECElastic Cloud· Sep 2, 2026

3. 5.4Med

   CVE-2026-78609 ↗ (opens in a new tab)

   Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.

   ECElastic Cloud· Sep 2, 2026

4. 5.3Med

   CVE-2026-78602 ↗ (opens in a new tab)

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.

   ECElastic Cloud· Sep 2, 2026

5. 5.5Med

   CVE-2026-78601 ↗ (opens in a new tab)

   Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

   ECElastic Cloud· Sep 2, 2026

6. 6.5Med

   CVE-2026-78599 ↗ (opens in a new tab)

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.

   ECElastic Cloud· Sep 2, 2026

7. 5.4Med

   CVE-2026-78598 ↗ (opens in a new tab)

   Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job management privileges within a single Kibana space could cause a job's saved object to become accessible across all spaces in the Kibana instance, without holding access rights to those additional spaces.

   ECElastic Cloud· Sep 2, 2026

8. 4.9Med

   CVE-2026-78594 ↗ (opens in a new tab)

   Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

   ECElastic Cloud· Sep 2, 2026

9. 6.3Med

   CVE-2026-78591 ↗ (opens in a new tab)

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.

   ECElastic Cloud· Sep 2, 2026

10. 6.5Med

    CVE-2026-78588 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.

    ECElastic Cloud· Sep 2, 2026

11. 6.5Med

    CVE-2026-78586 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.

    ECElastic Cloud· Sep 2, 2026

12. 4.3Med

    CVE-2026-78584 ↗ (opens in a new tab)

    Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

    ECElastic Cloud· Sep 2, 2026

13. 5.5Med

    CVE-2026-14255 ↗ (opens in a new tab)

    A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.

    AUAutodesk· Sep 2, 2026

14. 6.5Med

    CVE-2026-78608 ↗ (opens in a new tab)

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.

    ECElastic Cloud· Sep 1, 2026

15. 4.2Med

    CVE-2026-78606 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.

    ECElastic Cloud· Sep 1, 2026

16. 5.9Med

    CVE-2026-78605 ↗ (opens in a new tab)

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.

    ECElastic Cloud· Sep 1, 2026

17. 4.3Med

    CVE-2026-78603 ↗ (opens in a new tab)

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

    ECElastic Cloud· Sep 1, 2026

18. 4.3Med

    CVE-2026-78597 ↗ (opens in a new tab)

    Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

    ECElastic Cloud· Sep 1, 2026

19. 6.5Med

    CVE-2026-72682 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and denying service to all users of the instance.

    ECElastic Cloud· Sep 1, 2026

20. 6.5Med

    CVE-2026-72654 ↗ (opens in a new tab)

    Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather than the identity of the requesting user. Such a user could therefore receive data from Elasticsearch indices they are not authorized to read. No Elasticsearch cluster or index privileges are required.

    ECElastic Cloud· Sep 1, 2026

21. 6.5Med

    CVE-2026-72652 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.

    ECElastic Cloud· Sep 1, 2026

22. 6.5Med

    CVE-2026-72644 ↗ (opens in a new tab)

    Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.

    ECElastic Cloud· Sep 1, 2026

23. 5.4Med

    CVE-2026-72641 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store maintainer tasks, silently disabling Entity Analytics maintenance for that space.

    ECElastic Cloud· Sep 1, 2026

24. 4.3Med

    CVE-2026-72633 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.

    ECElastic Cloud· Sep 1, 2026

25. 6.5Med

    CVE-2026-72628 ↗ (opens in a new tab)

    Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.

    ECElastic Cloud· Sep 1, 2026

26. 6.5Med

    CVE-2026-63138 ↗ (opens in a new tab)

    Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic, returning data the user is not authorized to read.

    ECElastic Cloud· Sep 1, 2026

27. 4.9Med

    CVE-2026-56143 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted request that causes excessive memory consumption, which may render the affected node unavailable.

    ECElastic Cloud· Sep 1, 2026

28. 6.5Med

    CVE-2026-33465 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.

    ECElastic Cloud· Sep 1, 2026

29. 6.0Med

    CVE-2026-81533 ↗ (opens in a new tab)

    An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.

    MAMongoDB Atlas· Aug 28, 2026

30. 5.7Med

    CVE-2026-77184 ↗ (opens in a new tab)

    In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in deployments configured to build their SQL schema from those validators, can cause additional SQL text to be embedded in that generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

    MAMongoDB Atlas· Aug 28, 2026

31. 6.9Med

    CVE-2026-76798 ↗ (opens in a new tab)

    The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that repor

    MAMongoDB Atlas· Aug 28, 2026

32. 5.8Med

    CVE-2026-76797 ↗ (opens in a new tab)

    The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is re

    MAMongoDB Atlas· Aug 28, 2026

33. 4.8Med

    CVE-2026-76794 ↗ (opens in a new tab)

    MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

    MAMongoDB Atlas· Aug 28, 2026

34. 6.8Med

    CVE-2026-81530 ↗ (opens in a new tab)

    A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.

    MAMongoDB Atlas· Aug 27, 2026

35. 5.3Med

    CVE-2026-81528 ↗ (opens in a new tab)

    A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

    MAMongoDB Atlas· Aug 27, 2026

36. 6.9Med

    CVE-2026-81527 ↗ (opens in a new tab)

    A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended d

    MAMongoDB Atlas· Aug 27, 2026

37. 5.3Med

    CVE-2026-81524 ↗ (opens in a new tab)

    A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

    MAMongoDB Atlas· Aug 27, 2026

38. 4.1Med

    CVE-2026-75573 ↗ (opens in a new tab)

    In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

    MAMongoDB Atlas· Aug 27, 2026

39. 6.1Med

    CVE-2026-19854 ↗ (opens in a new tab)

    When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.

    GCGrafana Cloud· Aug 27, 2026

40. 6.5Med

    CVE-2026-77801 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.

    GIGitLab· Aug 26, 2026

41. 5.5Med

    CVE-2026-3035 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks.

    GIGitLab· Aug 26, 2026

42. 4.3Med

    CVE-2026-15387 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.

    GIGitLab· Aug 26, 2026

43. 6.5Med

    CVE-2025-10903 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.

    GIGitLab· Aug 26, 2026

44. 6.3Med

    CVE-2026-19197 ↗ (opens in a new tab)

    A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

    GCGrafana Cloud· Aug 26, 2026

45. 5.5Med

    CVE-2026-65088 ↗ (opens in a new tab)

    NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information. A successful exploit of this vulnerability might lead to information disclosure.

    NVNVIDIA· Aug 25, 2026

46. 6.1Med

    CVE-2026-65087 ↗ (opens in a new tab)

    NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering.

    NVNVIDIA· Aug 25, 2026

47. 6.8Med

    CVE-2026-65086 ↗ (opens in a new tab)

    NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

    NVNVIDIA· Aug 25, 2026

48. 5.2Med

    CVE-2026-65085 ↗ (opens in a new tab)

    NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering.

    NVNVIDIA· Aug 25, 2026

49. 6.0Med

    CVE-2026-47624 ↗ (opens in a new tab)

    NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi.

    NVNVIDIA· Aug 25, 2026

50. 6.0Med

    CVE-2026-24225 ↗ (opens in a new tab)

    NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure.

    NVNVIDIA· Aug 25, 2026