CVEs.

Latest CVEs

1. 4.3Med

   CVE-2026-14344 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory ID: MMSA-2026-00715

   MCMattermost Cloud· Sep 14, 2026

2. 4.3Med

   CVE-2026-14259 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00712

   MCMattermost Cloud· Sep 14, 2026

3. 4.3Med

   CVE-2026-13417 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value. Mattermost Advisory ID: MMSA-2026-00710

   MCMattermost Cloud· Sep 14, 2026

4. 4.3Med

   CVE-2026-12882 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703

   MCMattermost Cloud· Sep 14, 2026

5. 4.3Med

   CVE-2026-11993 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files constantly to the server.. Mattermost Advisory ID: MMSA-2026-00696

   MCMattermost Cloud· Sep 14, 2026

6. 5.3Med

   CVE-2026-10556 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

   MCMattermost Cloud· Sep 14, 2026

7. 4.3Med

   CVE-2026-10542 ↗ (opens in a new tab)

   Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692

   MCMattermost Cloud· Sep 14, 2026

8. 7.8High

   CVE-2026-90894 ↗ (opens in a new tab)

   Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

   JFJFrog· Sep 14, 2026

9. 9.9Crit

   CVE-2026-87719 ↗ (opens in a new tab)

   GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

   GIGitLab· Sep 12, 2026

10. 10.0Crit

    CVE-2026-85706 ↗ (opens in a new tab)Known exploited

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

    GIGitLab· Sep 12, 2026

11. 6.7Med

    CVE-2026-89332 ↗ (opens in a new tab)

    Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened. To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier

    AWAmazon Web Services· Sep 11, 2026

12. 7.7High

    CVE-2026-89099 ↗ (opens in a new tab)

    A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.

    MAMongoDB Atlas· Sep 11, 2026

13. 6.1Med

    CVE-2026-88036 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

14. 5.7Med

    CVE-2026-88035 ↗ (opens in a new tab)

    A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

    MAMongoDB Atlas· Sep 10, 2026

15. 6.1Med

    CVE-2026-88034 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

16. 6.1Med

    CVE-2026-88033 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

17. 8.2High

    CVE-2026-88032 ↗ (opens in a new tab)

    A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

    MAMongoDB Atlas· Sep 10, 2026

18. 7.1High

    CVE-2026-88021 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

19. 7.7High

    CVE-2026-87993 ↗ (opens in a new tab)

    The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

20. 5.4Med

    CVE-2026-87107 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

21. 6.5Med

    CVE-2026-87106 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

22. 8.3High

    CVE-2026-87090 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

23. 6.1Med

    CVE-2026-88031 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

24. 6.1Med

    CVE-2026-88030 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

25. 6.1Med

    CVE-2026-88029 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

26. 7.1High

    CVE-2026-88028 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target.

    MAMongoDB Atlas· Sep 10, 2026

27. 7.1High

    CVE-2026-88027 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

28. 7.1High

    CVE-2026-88026 ↗ (opens in a new tab)

    Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

    MAMongoDB Atlas· Sep 10, 2026

29. 6.1Med

    CVE-2026-88025 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

30. 6.1Med

    CVE-2026-88024 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

31. 6.1Med

    CVE-2026-88023 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

32. 8.4High

    CVE-2026-88022 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.

    MAMongoDB Atlas· Sep 10, 2026

33. 8.6High

    CVE-2026-85217 ↗ (opens in a new tab)

    A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy, potentially exposing sensitive information with the current user.

    AUAutodesk· Sep 10, 2026

34. 4.8Med

    CVE-2026-0304 ↗ (opens in a new tab)

    A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.

    PAPalo Alto Networks· Sep 10, 2026

35. 2.4Low

    CVE-2026-0303 ↗ (opens in a new tab)

    A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.

    PAPalo Alto Networks· Sep 10, 2026

36. 1.1Low

    CVE-2026-0302 ↗ (opens in a new tab)

    An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov.

    PAPalo Alto Networks· Sep 10, 2026

37. 7.2High

    CVE-2026-0310 ↗ (opens in a new tab)

    A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blog

    PAPalo Alto Networks· Sep 10, 2026

38. 4.0Med

    CVE-2026-0309 ↗ (opens in a new tab)

    A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

    PAPalo Alto Networks· Sep 10, 2026

39. 1.1Low

    CVE-2026-0308 ↗ (opens in a new tab)

    A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

    PAPalo Alto Networks· Sep 10, 2026

40. 5.9Med

    CVE-2026-0307 ↗ (opens in a new tab)

    Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. This GlobalProtect app on iOS, Android and ChromeOS is not impacted.

    PAPalo Alto Networks· Sep 10, 2026

41. 5.8Med

    CVE-2026-0306 ↗ (opens in a new tab)

    A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected.

    PAPalo Alto Networks· Sep 10, 2026

42. 4.3Med

    CVE-2026-0305 ↗ (opens in a new tab)

    An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials. The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.

    PAPalo Alto Networks· Sep 10, 2026

43. 5.5Med

    CVE-2026-85875 ↗ (opens in a new tab)

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

    M3Microsoft 365· Sep 8, 2026

44. 7.4High

    CVE-2026-84003 ↗ (opens in a new tab)

    Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.

    MAMicrosoft Azure· Sep 8, 2026

45. 5.5Med

    CVE-2026-83951 ↗ (opens in a new tab)

    Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

    M3Microsoft 365· Sep 8, 2026

46. 5.5Med

    CVE-2026-83949 ↗ (opens in a new tab)

    Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

    M3Microsoft 365· Sep 8, 2026

47. 7.8High

    CVE-2026-81960 ↗ (opens in a new tab)

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Sep 8, 2026

48. 7.8High

    CVE-2026-81959 ↗ (opens in a new tab)

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Sep 8, 2026

49. 5.5Med

    CVE-2026-81958 ↗ (opens in a new tab)

    Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

    M3Microsoft 365· Sep 8, 2026

50. 7.8High

    CVE-2026-81957 ↗ (opens in a new tab)

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Sep 8, 2026