CVEs.

Latest CVEs

1. 8.8High

   CVE-2026-2370 ↗ (opens in a new tab)

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

   GIGitLab· Mar 30, 2026

2. 2.1Low

   CVE-2026-4963 ↗ (opens in a new tab)

   A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

   HFHugging Face· Mar 27, 2026

3. 6.5Med

   CVE-2026-28375 ↗ (opens in a new tab)

   A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

   GCGrafana Cloud· Mar 27, 2026

4. 7.5High

   CVE-2026-27880 ↗ (opens in a new tab)

   The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

   GCGrafana Cloud· Mar 27, 2026

5. 6.5Med

   CVE-2026-27879 ↗ (opens in a new tab)

   A resample query can be used to trigger out-of-memory crashes in Grafana.

   GCGrafana Cloud· Mar 27, 2026

6. 7.5High

   CVE-2026-27877 ↗ (opens in a new tab)

   When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

   GCGrafana Cloud· Mar 27, 2026

7. 9.1Crit

   CVE-2026-27876 ↗ (opens in a new tab)

   A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an up

   GCGrafana Cloud· Mar 27, 2026

8. 9.3Crit

   CVE-2026-33728 ↗ (opens in a new tab)

   dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port ha

   DADatadog· Mar 27, 2026

9. 7.2High

   CVE-2026-33725 ↗ (opens in a new tab)

   Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the `POST /api/ee/serialization/import` endpoint. A crafted serialization archive injects an `INIT` property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud. This only affects Metabase Enterprise. Metabase OSS lacks the affe

   MCMetabase Cloud· Mar 27, 2026

10. 4.8Med

    CVE-2026-33682 ↗ (opens in a new tab)

    Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The vulnerability arises from improper validation of attacker-supplied filesystem paths. In certain code paths, including within the `ComponentRequestHandler`, filesystem paths are resolved using `os.path.realpath()` or `Path.resolve()` before sufficient validation occurs. On Windows systems, supplying a malicious UNC path (e.g., `\\attacker-controlled-host\share`) can cause t

    SNSnowflake· Mar 26, 2026

11. 7.5High

    CVE-2026-28377 ↗ (opens in a new tab)

    A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.

    GCGrafana Cloud· Mar 26, 2026

12. 6.5Med

    CVE-2026-33375 ↗ (opens in a new tab)

    The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

    GCGrafana Cloud· Mar 26, 2026

13. 4.3Med

    CVE-2026-21724 ↗ (opens in a new tab)

    A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

    GCGrafana Cloud· Mar 26, 2026

14. 4.9Med

    CVE-2026-3116 ↗ (opens in a new tab)

    Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows an authenticated attacker to cause service disruption via the webhook endpoint. Mattermost Advisory ID: MMSA-2026-00589

    MCMattermost Cloud· Mar 26, 2026

15. 4.3Med

    CVE-2026-3115 ↗ (opens in a new tab)

    Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594

    MCMattermost Cloud· Mar 26, 2026

16. 6.5Med

    CVE-2026-3114 ↗ (opens in a new tab)

    Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate decompressed archive entry sizes during file extraction which allows authenticated users with file upload permissions to cause a denial of service via crafted zip archives containing highly compressed entries (zip bombs) that exhaust server memory.. Mattermost Advisory ID: MMSA-2026-00598

    MCMattermost Cloud· Mar 26, 2026

17. 5.5Med

    CVE-2026-3113 ↗ (opens in a new tab)

    Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export.. Mattermost Advisory ID: MMSA-2026-00593

    MCMattermost Cloud· Mar 26, 2026

18. 4.9Med

    CVE-2026-3112 ↗ (opens in a new tab)

    Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in support packet generation. Mattermost Advisory ID: MMSA-2025-00562

    MCMattermost Cloud· Mar 26, 2026

19. 2.2Low

    CVE-2026-3109 ↗ (opens in a new tab)

    Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584

    MCMattermost Cloud· Mar 26, 2026

20. 8.8High

    CVE-2026-3108 ↗ (opens in a new tab)

    Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599

    MCMattermost Cloud· Mar 26, 2026

21. 5.4Med

    CVE-2026-4274 ↗ (opens in a new tab)

    Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574

    MCMattermost Cloud· Mar 26, 2026

22. 7.5High

    CVE-2026-3988 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.

    GIGitLab· Mar 25, 2026

23. 8.8High

    CVE-2026-3857 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

    GIGitLab· Mar 25, 2026

24. 5.4Med

    CVE-2026-2995 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.

    GIGitLab· Mar 25, 2026

25. 5.4Med

    CVE-2026-2973 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

    GIGitLab· Mar 25, 2026

26. 8.1High

    CVE-2026-2745 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts due to inconsistent input validation in the authentication process.

    GIGitLab· Mar 25, 2026

27. 4.3Med

    CVE-2026-2726 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to perform unauthorized actions on merge requests in other projects due to improper access control during cross-repository operations.

    GIGitLab· Mar 25, 2026

28. 4.6Med

    CVE-2026-27659 ↗ (opens in a new tab)

    Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578

    MCMattermost Cloud· Mar 25, 2026

29. 6.1Med

    CVE-2026-27656 ↗ (opens in a new tab)

    Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow.. Mattermost Advisory ID: MMSA-2026-00590

    MCMattermost Cloud· Mar 25, 2026

30. 6.5Med

    CVE-2026-26233 ↗ (opens in a new tab)

    Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated remote attackers to cause denial of service (server crash and restart) via HTTP/2 single packet attack with 100+ parallel login requests.. Mattermost Advisory ID: MMSA-2025-00566

    MCMattermost Cloud· Mar 25, 2026

31. 7.5High

    CVE-2026-20719 ↗ (opens in a new tab)

    Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID: MMSA-2026-00595

    MCMattermost Cloud· Mar 25, 2026

32. 7.5High

    CVE-2026-1724 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.

    GIGitLab· Mar 25, 2026

33. 4.3Med

    CVE-2025-14595 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control

    GIGitLab· Mar 25, 2026

34. 6.5Med

    CVE-2025-13436 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when handling certain CI-related inputs.

    GIGitLab· Mar 25, 2026

35. 6.5Med

    CVE-2025-13078 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration inputs.

    GIGitLab· Mar 25, 2026

36. 3.7Low

    CVE-2026-4363 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.

    GIGitLab· Mar 25, 2026

37. 1.9Low

    CVE-2026-4433 ↗ (opens in a new tab)

    An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to potentially glean information about the underlying system and give an attacker information that could be used to attempt to compromise the host.

    TETenable· Mar 24, 2026

38. 9.8Crit

    CVE-2026-24159 ↗ (opens in a new tab)

    NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.

    NVNVIDIA· Mar 24, 2026

39. 7.5High

    CVE-2026-24158 ↗ (opens in a new tab)

    NVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a large compressed payload. A successful exploit of this vulnerability may lead to denial of service.

    NVNVIDIA· Mar 24, 2026

40. 9.8Crit

    CVE-2026-24157 ↗ (opens in a new tab)

    NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.

    NVNVIDIA· Mar 24, 2026

41. 7.8High

    CVE-2026-24152 ↗ (opens in a new tab)

    NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Mar 24, 2026

42. 7.8High

    CVE-2026-24151 ↗ (opens in a new tab)

    NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Mar 24, 2026

43. 7.8High

    CVE-2026-24150 ↗ (opens in a new tab)

    NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Mar 24, 2026

44. 7.8High

    CVE-2026-24141 ↗ (opens in a new tab)

    NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

    NVNVIDIA· Mar 24, 2026

45. 7.5High

    CVE-2025-33254 ↗ (opens in a new tab)

    NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may lead to a denial of service.

    NVNVIDIA· Mar 24, 2026

46. 7.8High

    CVE-2025-33248 ↗ (opens in a new tab)

    NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Mar 24, 2026

47. 7.8High

    CVE-2025-33247 ↗ (opens in a new tab)

    NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Mar 24, 2026

48. 9.0Crit

    CVE-2025-33244 ↗ (opens in a new tab)

    NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects environments that use PyTorch versions earlier than 2.6. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, data tampering, and information disclosure.

    NVNVIDIA· Mar 24, 2026

49. 5.9Med

    CVE-2025-33242 ↗ (opens in a new tab)

    NVIDIA B300 MCU contains a vulnerability in the CX8 MCU that could allow a malicious actor to modify unsupported registries, causing a bad state. A successful exploit of this vulnerability might lead to denial of service and data tampering.

    NVNVIDIA· Mar 24, 2026

50. 7.5High

    CVE-2025-33238 ↗ (opens in a new tab)

    NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerability may lead to denial of service.

    NVNVIDIA· Mar 24, 2026