CVEs.

Latest CVEs

1. 8.6High

   CVE-2026-18145 ↗ (opens in a new tab)

   A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.

   WAWatchGuard· Sep 30, 2026

2. 7.1High

   CVE-2026-18105 ↗ (opens in a new tab)

   An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.

   WAWatchGuard· Sep 30, 2026

3. 8.2High

   CVE-2026-13224 ↗ (opens in a new tab)

   A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.

   WAWatchGuard· Sep 30, 2026

4. 7.5High

   CVE-2026-13046 ↗ (opens in a new tab)

   A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

   WAWatchGuard· Sep 30, 2026

5. 4.3Med

   CVE-2026-81842 ↗ (opens in a new tab)

   An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.

   GCGrafana Cloud· Sep 29, 2026

6. 5.3Med

   CVE-2026-81841 ↗ (opens in a new tab)

   Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

   GCGrafana Cloud· Sep 29, 2026

7. 7.0High

   CVE-2026-92371 ↗ (opens in a new tab)

   TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.

   TETeamViewer· Sep 29, 2026

8. 8.8High

   CVE-2026-92370 ↗ (opens in a new tab)

   An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.

   TETeamViewer· Sep 29, 2026

9. 7.3High

   CVE-2026-92369 ↗ (opens in a new tab)

   TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.

   TETeamViewer· Sep 29, 2026

10. 7.8High

    CVE-2026-92368 ↗ (opens in a new tab)

    TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user

    TETeamViewer· Sep 29, 2026

11. 7.8High

    CVE-2026-19743 ↗ (opens in a new tab)

    Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.

    TETeamViewer· Sep 29, 2026

12. 7.8High

    CVE-2026-65102 ↗ (opens in a new tab)

    NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful exploit of this vulnerability might lead to denial of service, information disclosure, data tampering.

    NVNVIDIA· Sep 29, 2026

13. 6.8Med

    CVE-2025-33207 ↗ (opens in a new tab)

    NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service.

    NVNVIDIA· Sep 29, 2026

14. 4.3Med

    CVE-2026-8937 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they had no access to, due to missing authorization checks on linked work items within visible epics.

    GIGitLab· Sep 29, 2026

15. 8.7High

    CVE-2026-84739 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.

    GIGitLab· Sep 29, 2026

16. 3.7Low

    CVE-2026-4523 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API.

    GIGitLab· Sep 29, 2026

17. 4.3Med

    CVE-2026-10518 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement.

    GIGitLab· Sep 29, 2026

18. 9.6Crit

    CVE-2026-12342 ↗ (opens in a new tab)

    This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

    SASailPoint· Sep 28, 2026

19. 4.9Med

    CVE-2026-94408 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    ECElastic Cloud· Sep 26, 2026

20. 6.5Med

    CVE-2026-94400 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

    ECElastic Cloud· Sep 26, 2026

21. 6.5Med

    CVE-2026-94399 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    ECElastic Cloud· Sep 26, 2026

22. 6.5Med

    CVE-2026-94398 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    ECElastic Cloud· Sep 26, 2026

23. 6.5Med

    CVE-2026-94397 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    ECElastic Cloud· Sep 26, 2026

24. 6.5Med

    CVE-2026-94396 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    ECElastic Cloud· Sep 26, 2026

25. 6.5Med

    CVE-2026-82300 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

    ECElastic Cloud· Sep 26, 2026

26. 6.5Med

    CVE-2026-82294 ↗ (opens in a new tab)

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

    ECElastic Cloud· Sep 26, 2026

27. 6.5Med

    CVE-2026-78582 ↗ (opens in a new tab)

    Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.

    ECElastic Cloud· Sep 26, 2026

28. 7.3High

    CVE-2026-72668 ↗ (opens in a new tab)

    Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

    ECElastic Cloud· Sep 26, 2026

29. 6.3Med

    CVE-2026-72662 ↗ (opens in a new tab)

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

    ECElastic Cloud· Sep 26, 2026

30. 8.1High

    CVE-2026-100208 ↗ (opens in a new tab)

    Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

    M3Microsoft 365· Sep 25, 2026

31. 7.5High

    CVE-2026-96749 ↗ (opens in a new tab)

    An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer ins

    MAMongoDB Atlas· Sep 24, 2026

32. 8.3High

    CVE-2026-96748 ↗ (opens in a new tab)

    PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

    MAMongoDB Atlas· Sep 24, 2026

33. 5.3Med

    CVE-2026-96747 ↗ (opens in a new tab)

    The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.

    MAMongoDB Atlas· Sep 24, 2026

34. 7.3High

    CVE-2026-96750 ↗ (opens in a new tab)

    MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

    MAMongoDB Atlas· Sep 24, 2026

35. 8.3High

    CVE-2026-96746 ↗ (opens in a new tab)

    An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

    MAMongoDB Atlas· Sep 24, 2026

36. 6.3Med

    CVE-2026-96745 ↗ (opens in a new tab)

    Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the applica

    MAMongoDB Atlas· Sep 24, 2026

37. 7.1High

    CVE-2026-96744 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.

    MAMongoDB Atlas· Sep 24, 2026

38. 9.9Crit

    CVE-2026-93577 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

    GIGitLab· Sep 24, 2026

39. 5.4Med

    CVE-2026-92874 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to improper authorization checks.

    GIGitLab· Sep 24, 2026

40. 3.1Low

    CVE-2026-92628 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.

    GIGitLab· Sep 24, 2026

41. 4.3Med

    CVE-2026-92530 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.

    GIGitLab· Sep 24, 2026

42. 4.3Med

    CVE-2026-92529 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control due to improper authorization checks.

    GIGitLab· Sep 24, 2026

43. 7.7High

    CVE-2026-92470 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

    GIGitLab· Sep 24, 2026

44. 9.9Crit

    CVE-2026-89078 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

    GIGitLab· Sep 24, 2026

45. 7.8High

    CVE-2026-70125 ↗ (opens in a new tab)

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Sep 23, 2026

46. 9.3Crit

    CVE-2026-96770 ↗ (opens in a new tab)

    All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.

    TCTemporal Cloud· Sep 23, 2026

47. 7.4High

    CVE-2026-95676 ↗ (opens in a new tab)

    A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply.

    WAWatchGuard· Sep 23, 2026

48. 6.3Med

    CVE-2026-96456 ↗ (opens in a new tab)

    The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler t

    JFJFrog· Sep 23, 2026

49. 8.8High

    CVE-2026-96455 ↗ (opens in a new tab)

    The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just hands back the manager object from application state, so nothing in the chain ever checks a credential. The endpoint takes an AppInfo body naming a Hugging Face Space. The daemon downloads that Space and installs it as a Python package through install_package in src/reachy_mini/apps/sources/local_common_venv.py, using uv or pip. Installing a

    JFJFrog· Sep 23, 2026

50. 8.2High

    CVE-2026-96454 ↗ (opens in a new tab)

    Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with "remote": { "urls": ["https://*.*"] }. That wildcard tells Tauri to accept IPC from any HTTPS origin, not just the site the application was built to wrap. The second is "withGlobalTauri": true in src-tauri/tauri.conf.json, which puts window.__TAURI__.core.invoke() in reach of ordinary page JavaScript.

    JFJFrog· Sep 23, 2026