CVEs.

Latest CVEs

1. 7.1High

   CVE-2026-82055 ↗ (opens in a new tab)

   A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.

   MAMongoDB Atlas· Sep 8, 2026

2. 7.1High

   CVE-2026-82054 ↗ (opens in a new tab)

   A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

   MAMongoDB Atlas· Sep 8, 2026

3. 7.6High

   CVE-2026-82053 ↗ (opens in a new tab)

   A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.

   MAMongoDB Atlas· Sep 8, 2026

4. 7.1High

   CVE-2026-82052 ↗ (opens in a new tab)

   The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

   MAMongoDB Atlas· Sep 8, 2026

5. 7.5High

   CVE-2026-47625 ↗ (opens in a new tab)

   NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

   NVNVIDIA· Sep 8, 2026

6. 7.5High

   CVE-2026-16497 ↗ (opens in a new tab)

   NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service.

   NVNVIDIA· Sep 8, 2026

7. 8.1High

   CVE-2026-86242 ↗ (opens in a new tab)

   Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for cust

   JFJFrog· Sep 6, 2026

8. 10.0Crit

   CVE-2026-83711 ↗ (opens in a new tab)

   Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

   MAMicrosoft Azure· Sep 3, 2026

9. 10.0Crit

   CVE-2026-80098 ↗ (opens in a new tab)

   Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.

   M3Microsoft 365· Sep 3, 2026

10. 10.0Crit

    CVE-2026-70352 ↗ (opens in a new tab)

    Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.

    MAMicrosoft Azure· Sep 3, 2026

11. 8.8High

    CVE-2026-69857 ↗ (opens in a new tab)

    Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.

    MAMicrosoft Azure· Sep 3, 2026

12. 8.1High

    CVE-2026-82302 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

    ECElastic Cloud· Sep 3, 2026

13. 6.5Med

    CVE-2026-82299 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

    ECElastic Cloud· Sep 3, 2026

14. 4.3Med

    CVE-2026-82298 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

    ECElastic Cloud· Sep 3, 2026

15. 4.3Med

    CVE-2026-78596 ↗ (opens in a new tab)

    Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.

    ECElastic Cloud· Sep 3, 2026

16. 4.3Med

    CVE-2026-78595 ↗ (opens in a new tab)

    Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.

    ECElastic Cloud· Sep 3, 2026

17. 4.3Med

    CVE-2026-78593 ↗ (opens in a new tab)

    An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.

    ECElastic Cloud· Sep 3, 2026

18. 8.1High

    CVE-2026-78583 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration.

    ECElastic Cloud· Sep 3, 2026

19. 6.9Med

    CVE-2026-84968 ↗ (opens in a new tab)

    An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

    MAMongoDB Atlas· Sep 3, 2026

20. 5.1Med

    CVE-2026-84967 ↗ (opens in a new tab)

    A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not displ

    MAMongoDB Atlas· Sep 3, 2026

21. 5.9Med

    CVE-2026-84966 ↗ (opens in a new tab)

    An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.

    MAMongoDB Atlas· Sep 3, 2026

22. 5.9Med

    CVE-2026-84965 ↗ (opens in a new tab)

    An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

    MAMongoDB Atlas· Sep 3, 2026

23. 8.2High

    CVE-2026-84964 ↗ (opens in a new tab)

    A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

    MAMongoDB Atlas· Sep 3, 2026

24. 6.3Med

    CVE-2026-84963 ↗ (opens in a new tab)

    An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

    MAMongoDB Atlas· Sep 3, 2026

25. 5.7Med

    CVE-2026-84962 ↗ (opens in a new tab)

    An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

    MAMongoDB Atlas· Sep 3, 2026

26. 7.4High

    CVE-2026-75034 ↗ (opens in a new tab)

    A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim. This issue affects Rancher: before 2.15.1.

    SUSUSE· Sep 3, 2026

27. 7.1High

    CVE-2026-84971 ↗ (opens in a new tab)

    Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

    MAMongoDB Atlas· Sep 3, 2026

28. 5.9Med

    CVE-2026-84970 ↗ (opens in a new tab)

    A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

    MAMongoDB Atlas· Sep 3, 2026

29. 6.3Med

    CVE-2026-84969 ↗ (opens in a new tab)

    A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

    MAMongoDB Atlas· Sep 3, 2026

30. 6.5Med

    CVE-2026-19475 ↗ (opens in a new tab)

    An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

    GCGrafana Cloud· Sep 2, 2026

31. 8.1High

    CVE-2026-14199 ↗ (opens in a new tab)

    Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).

    GCGrafana Cloud· Sep 2, 2026

32. 6.8Med

    CVE-2026-12704 ↗ (opens in a new tab)

    When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

    GCGrafana Cloud· Sep 2, 2026

33. 4.3Med

    CVE-2026-82293 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.

    ECElastic Cloud· Sep 2, 2026

34. 5.4Med

    CVE-2026-78609 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.

    ECElastic Cloud· Sep 2, 2026

35. 7.8High

    CVE-2026-78604 ↗ (opens in a new tab)

    Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.

    ECElastic Cloud· Sep 2, 2026

36. 5.3Med

    CVE-2026-78602 ↗ (opens in a new tab)

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.

    ECElastic Cloud· Sep 2, 2026

37. 5.5Med

    CVE-2026-78601 ↗ (opens in a new tab)

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

    ECElastic Cloud· Sep 2, 2026

38. 3.5Low

    CVE-2026-78600 ↗ (opens in a new tab)

    Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.

    ECElastic Cloud· Sep 2, 2026

39. 6.5Med

    CVE-2026-78599 ↗ (opens in a new tab)

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.

    ECElastic Cloud· Sep 2, 2026

40. 5.4Med

    CVE-2026-78598 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job management privileges within a single Kibana space could cause a job's saved object to become accessible across all spaces in the Kibana instance, without holding access rights to those additional spaces.

    ECElastic Cloud· Sep 2, 2026

41. 4.9Med

    CVE-2026-78594 ↗ (opens in a new tab)

    Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

    ECElastic Cloud· Sep 2, 2026

42. 6.3Med

    CVE-2026-78591 ↗ (opens in a new tab)

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.

    ECElastic Cloud· Sep 2, 2026

43. 7.3High

    CVE-2026-78590 ↗ (opens in a new tab)

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface.

    ECElastic Cloud· Sep 2, 2026

44. 6.5Med

    CVE-2026-78588 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.

    ECElastic Cloud· Sep 2, 2026

45. 3.1Low

    CVE-2026-78587 ↗ (opens in a new tab)

    Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.

    ECElastic Cloud· Sep 2, 2026

46. 6.5Med

    CVE-2026-78586 ↗ (opens in a new tab)

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.

    ECElastic Cloud· Sep 2, 2026

47. 4.3Med

    CVE-2026-78584 ↗ (opens in a new tab)

    Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

    ECElastic Cloud· Sep 2, 2026

48. 5.5Med

    CVE-2026-14255 ↗ (opens in a new tab)

    A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.

    AUAutodesk· Sep 2, 2026

49. 7.7High

    CVE-2026-76851 ↗ (opens in a new tab)

    A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server

    GIGitHub· Sep 1, 2026

50. 7.7High

    CVE-2026-19118 ↗ (opens in a new tab)

    A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.

    GIGitHub· Sep 1, 2026