CVEs.

Latest CVEs

1. 7.7High

   CVE-2026-95627 ↗ (opens in a new tab)

   When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.

   JFJFrog· Sep 23, 2026

2. 8.3High

   CVE-2026-95626 ↗ (opens in a new tab)

   Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.

   JFJFrog· Sep 23, 2026

3. 5.9Med

   CVE-2026-95625 ↗ (opens in a new tab)

   The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.

   JFJFrog· Sep 23, 2026

4. 6.5Med

   CVE-2026-96260 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.. Mattermost Advisory ID: MMSA-2026-00775

   MCMattermost Cloud· Sep 22, 2026

5. 5.5Med

   CVE-2026-96259 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776

   MCMattermost Cloud· Sep 22, 2026

6. 9.3Crit

   CVE-2026-77987 ↗ (opens in a new tab)

   A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code exe

   GIGitHub· Sep 22, 2026

7. 7.4High

   CVE-2026-77912 ↗ (opens in a new tab)

   A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without re-sanitizing the result. Crafted Markdown could abuse same-origin JavaScript gadgets to bypass Content Security Policy and gain control of the page DOM when viewed by another user. Successful exploitation could allow an attacker to read content visible to the victim, extract embedded CSRF tokens, perform sta

   GIGitHub· Sep 22, 2026

8. 6.0Med

   CVE-2026-75101 ↗ (opens in a new tab)

   An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to the repository name and pull request number rather than to a globally unique repository identifier, so an attacker who created a repository and pull request matching a target's repository name and pull request number could use a token for their own repository to retrieve the private pull request's conten

   GIGitHub· Sep 22, 2026

9. 6.8Med

   CVE-2026-95624 ↗ (opens in a new tab)

   The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.

   JFJFrog· Sep 22, 2026

10. 8.1High

    CVE-2026-87902 ↗ (opens in a new tab)Known exploited

    An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

    WCWordPress.com (Automattic)· Sep 22, 2026

11. 8.8High

    CVE-2026-65179 ↗ (opens in a new tab)

    NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026

12. 7.8High

    CVE-2026-65178 ↗ (opens in a new tab)

    NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026

13. 9.8Crit

    CVE-2026-65130 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026

14. 8.3High

    CVE-2026-65129 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

    NVNVIDIA· Sep 22, 2026

15. 8.8High

    CVE-2026-65128 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026

16. 4.9Med

    CVE-2026-65127 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to information disclosure.

    NVNVIDIA· Sep 22, 2026

17. 8.8High

    CVE-2026-65126 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026

18. 8.8High

    CVE-2026-65125 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.

    NVNVIDIA· Sep 22, 2026

19. 8.1High

    CVE-2026-65124 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service.

    NVNVIDIA· Sep 22, 2026

20. 9.8Crit

    CVE-2026-65121 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Sep 22, 2026

21. 9.8Crit

    CVE-2026-65118 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

    NVNVIDIA· Sep 22, 2026

22. 8.8High

    CVE-2026-65117 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026

23. 6.5Med

    CVE-2026-65115 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successful exploit of this vulnerability may lead to denial of service.

    NVNVIDIA· Sep 22, 2026

24. 9.8Crit

    CVE-2026-65114 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026

25. 9.8Crit

    CVE-2026-65113 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026

26. 6.5Med

    CVE-2026-65112 ↗ (opens in a new tab)

    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.

    NVNVIDIA· Sep 22, 2026

27. 7.8High

    CVE-2026-65111 ↗ (opens in a new tab)

    NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

    NVNVIDIA· Sep 22, 2026

28. 7.8High

    CVE-2026-24267 ↗ (opens in a new tab)

    NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Sep 22, 2026

29. 7.8High

    CVE-2026-24239 ↗ (opens in a new tab)

    NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

    NVNVIDIA· Sep 22, 2026

30. 4.3Med

    CVE-2026-95666 ↗ (opens in a new tab)

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771

    MCMattermost Cloud· Sep 22, 2026

31. 5.6Med

    CVE-2026-95623 ↗ (opens in a new tab)

    The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.

    JFJFrog· Sep 22, 2026

32. 8.7High

    CVE-2026-89139 ↗ (opens in a new tab)

    Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller's request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a c

    TCTemporal Cloud· Sep 21, 2026

33. 7.2High

    CVE-2026-87858 ↗ (opens in a new tab)

    Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving th

    TCTemporal Cloud· Sep 21, 2026

34. 8.7High

    CVE-2026-65654 ↗ (opens in a new tab)

    github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses containing label keys, values, or counts that exceed the receiver's configured limits. Accepted labels are retained in the member list and disseminated to peers, allowing memory and gossip-bandwidth consumption to exceed configured bounds and potential

    TCTemporal Cloud· Sep 21, 2026

35. 8.7High

    CVE-2026-65653 ↗ (opens in a new tab)

    github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against app

    TCTemporal Cloud· Sep 21, 2026

36. 8.7High

    CVE-2026-65652 ↗ (opens in a new tab)

    github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiali

    TCTemporal Cloud· Sep 21, 2026

37. 8.7High

    CVE-2026-65651 ↗ (opens in a new tab)

    temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query

    TCTemporal Cloud· Sep 21, 2026

38. 7.1High

    CVE-2026-16652 ↗ (opens in a new tab)

    Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without addit

    TCTemporal Cloud· Sep 21, 2026

39. 8.7High

    CVE-2026-16651 ↗ (opens in a new tab)

    temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permiss

    TCTemporal Cloud· Sep 21, 2026

40. 7.1High

    CVE-2026-93764 ↗ (opens in a new tab)

    Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.

    MAMongoDB Atlas· Sep 18, 2026

41. 7.1High

    CVE-2026-93763 ↗ (opens in a new tab)

    A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.

    MAMongoDB Atlas· Sep 18, 2026

42. 9.2Crit

    CVE-2026-93762 ↗ (opens in a new tab)

    Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.

    MAMongoDB Atlas· Sep 18, 2026

43. 8.7High

    CVE-2026-93761 ↗ (opens in a new tab)

    An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.

    MAMongoDB Atlas· Sep 18, 2026

44. 8.3High

    CVE-2026-93760 ↗ (opens in a new tab)

    Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.

    MAMongoDB Atlas· Sep 18, 2026

45. 8.8High

    CVE-2026-93759 ↗ (opens in a new tab)

    Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.

    MAMongoDB Atlas· Sep 18, 2026

46. 8.3High

    CVE-2026-93765 ↗ (opens in a new tab)

    Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.

    MAMongoDB Atlas· Sep 18, 2026

47. 8.6High

    CVE-2026-93758 ↗ (opens in a new tab)

    An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

    MAMongoDB Atlas· Sep 18, 2026

48. 9.9Crit

    CVE-2026-85878 ↗ (opens in a new tab)

    Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.

    MAMicrosoft Azure· Sep 18, 2026

49. 6.1Med

    CVE-2026-83946 ↗ (opens in a new tab)

    Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.

    MAMicrosoft Azure· Sep 18, 2026

50. 9.8Crit

    CVE-2026-62874 ↗ (opens in a new tab)

    Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.

    MAMicrosoft Azure· Sep 18, 2026