[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106458 | 6 Oct 2026 | CVSS 6.5 | Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updatesBackstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server… | Fix |
| CVE-2026-106459 | 6 Oct 2026 | CVSS 8.5 | Backstage: Improper input validation in Sentry scaffolder actionsBackstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package… | Fix |
| CVE-2026-106460 | 6 Oct 2026 | CVSS 6.8 | Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalizationBackstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not… | Fix |
| CVE-2026-106461 | 6 Oct 2026 | CVSS 4.3 | Backstage: Incorrect authorization in scaffolder task listingBackstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by… | Fix |
| CVE-2026-106455 | 6 Oct 2026 | CVSS 7.7 | Backstage: Improper validation of MkDocs plugin configuration in TechDocsBackstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is… | Fix |
| CVE-2026-106456 | 6 Oct 2026 | CVSS 4.8 | Backstage: Inconsistent credential enforcement for overlapping proxy routesBackstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by… | Fix |
| CVE-2026-104045 | 6 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between… | |
| CVE-2026-104046 | 6 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests… | |
| CVE-2026-105811 | 6 Oct 2026 | CVSS 6.5 | aws qnabot-on-awsAuthorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook… | |
| CVE-2026-105812 | 6 Oct 2026 | CVSS 9.0 | aws bedrock-agentcore-starter-toolkitImproper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an… | |
| CVE-2026-106032 | 6 Oct 2026 | CVSS 5.7 | aws bedrock-agentcore-starter-toolkitServer-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before… | |
| CVE-2026-106062 | 6 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width… | |
| CVE-2026-101258 | 6 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute… | |
| CVE-2026-96399 | 6 Oct 2026 | CVSS 7.5 | GiteaA repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea… | Fix |
| CVE-2026-96400 | 6 Oct 2026 | CVSS 4.3 | GiteaWith `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit… | Fix |
| CVE-2026-96404 | 6 Oct 2026 | CVSS 8.1 | GiteaWhen Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`… | Fix |
| CVE-2026-96580 | 6 Oct 2026 | CVSS 7.5 | GiteaGitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull… | Fix |
| CVE-2026-96589 | 6 Oct 2026 | CVSS 4.3 | GiteaWhen a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can… | Fix |
| CVE-2026-89430 | 6 Oct 2026 | CVSS 8.1 | GiteaGitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each… | Fix |
| CVE-2026-94114 | 6 Oct 2026 | CVSS 5.9 | Apache Software Foundation Apache Commons BCELSymbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested… | |
| CVE-2026-94205 | 6 Oct 2026 | CVSS 9.8 | GiteaGitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author… | Fix |
| CVE-2026-95106 | 6 Oct 2026 | CVSS 9.1 | GiteaGitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such… | Fix |
| CVE-2026-95112 | 6 Oct 2026 | CVSS 6.5 | GiteaWhen processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown… | Fix |
| CVE-2026-79814 | 6 Oct 2026 | CVSS 6.7 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their… | |
| CVE-2026-79815 | 6 Oct 2026 | CVSS 6.5 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary… | |
| CVE-2026-79816 | 6 Oct 2026 | CVSS 6.3 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a… | |
| CVE-2026-79817 | 6 Oct 2026 | CVSS 5.5 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager. Successful exploitation… | |
| CVE-2026-79818 | 6 Oct 2026 | CVSS 5.3 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication… | |
| CVE-2026-79960 | 6 Oct 2026 | CVSS 7.1 | GiteaWhen a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline… | Fix |
| CVE-2026-79805 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify… | |
| CVE-2026-79806 | 6 Oct 2026 | CVSS 7.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate… | |
| CVE-2026-79807 | 6 Oct 2026 | CVSS 7.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local… | |
| CVE-2026-79808 | 6 Oct 2026 | CVSS 7.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an authenticated local… | |
| CVE-2026-79809 | 6 Oct 2026 | CVSS 7.3 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability… | |
| CVE-2026-79810 | 6 Oct 2026 | CVSS 7.2 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated… | |
| CVE-2026-79811 | 6 Oct 2026 | CVSS 7.2 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to… | |
| CVE-2026-79812 | 6 Oct 2026 | CVSS 6.1 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an… | |
| CVE-2026-79813 | 6 Oct 2026 | CVSS 6.7 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user… | |
| CVE-2026-79796 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote… | |
| CVE-2026-79797 | 6 Oct 2026 | CVSS 8.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application… | |
| CVE-2026-79798 | 6 Oct 2026 | CVSS 9.9 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote… | |
| CVE-2026-79799 | 6 Oct 2026 | CVSS 8.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored… | |
| CVE-2026-79800 | 6 Oct 2026 | CVSS 8.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a… | |
| CVE-2026-79801 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated… | |
| CVE-2026-79802 | 6 Oct 2026 | CVSS 8.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is… | |
| CVE-2026-79803 | 6 Oct 2026 | CVSS 8.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker… | |
| CVE-2026-76747 | 6 Oct 2026 | CVSS 9.1 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to… | |
| CVE-2026-76748 | 6 Oct 2026 | CVSS 8.8 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate… | |
| CVE-2026-76749 | 6 Oct 2026 | CVSS 6.5 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)A sensitive information disclosure vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated remote attacker to access… | |
| CVE-2026-76750 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation… | |
| CVE-2026-76751 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an… | |
| CVE-2026-76752 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful… | |
| CVE-2026-76753 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote… | |
| CVE-2026-76754 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks… | |
| CVE-2026-79794 | 6 Oct 2026 | CVSS 9.1 | Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to… | |
| CVE-2026-73278 | 6 Oct 2026 | CVSS 9.8 | GiteaGitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A… | Fix |
| CVE-2026-76061 | 6 Oct 2026 | CVSS 5.5 | Red Hat OpenShift Container Platform 4A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local… | |
| CVE-2026-76741 | 6 Oct 2026 | CVSS 6.5 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an authenticated remote attacker to… | |
| CVE-2026-76742 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote… | |
| CVE-2026-76743 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to… | |
| CVE-2026-76744 | 6 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to… | |
| CVE-2026-76745 | 6 Oct 2026 | CVSS 9.6 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an… | |
| CVE-2026-76746 | 6 Oct 2026 | CVSS 9.3 | Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose… | |
| CVE-2026-70357 | 6 Oct 2026 | CVSS 7.5 | GiteaGitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently… | Fix |
| CVE-2026-106450 | 6 Oct 2026 | CVSS 5.3 | yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsyawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block… | Fix |
| CVE-2026-106451 | 6 Oct 2026 | CVSS 7.3 | yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local useryawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an… | Fix |
| CVE-2026-106452 | 6 Oct 2026 | CVSS 5.3 | yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headeryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen… | Fix |
| CVE-2026-106453 | 6 Oct 2026 | CVSS 5.3 | yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErroryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte… | Fix |
| CVE-2026-106454 | 6 Oct 2026 | CVSS 4.3 | Twisted: IMAP wildcardToRegexp() ReDoSTwisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in… | |
| CVE-2026-106444 | 6 Oct 2026 | CVSS 4.7 | Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled TemplatesHandlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString()… | Fix |
| CVE-2026-106445 | 6 Oct 2026 | CVSS 9.2 | Handlebars: JavaScript Injection via Own Property Check BypassHandlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns… | Fix |
| CVE-2026-106446 | 6 Oct 2026 | CVSS 9.8 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and… | Fix |
| CVE-2026-106447 | 6 Oct 2026 | CVSS 8.7 | stablelibStableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR… | |
| CVE-2026-106448 | 6 Oct 2026 | CVSS 8.9 | stablelibStableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary… | |
| CVE-2026-106449 | 6 Oct 2026 | CVSS 3.7 | yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErroryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false… | Fix |
| CVE-2026-106063 | 6 Oct 2026 | CVSS 6.3 | Red Hat Enterprise Linux 10A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path… | |
| CVE-2026-105242 | 6 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache log4netImproper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters… | Fix |
| CVE-2026-105243 | 6 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache log4netInsufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the… | Fix |
| CVE-2026-105244 | 6 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache log4netImproper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space… | Fix |
| CVE-2026-104626 | 6 Oct 2026 | CVSS 8.8 | GiteaA user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is… | Fix |
| CVE-2026-104632 | 6 Oct 2026 | CVSS 8.8 | GiteaGitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path… | Fix |
| CVE-2026-104636 | 6 Oct 2026 | CVSS 7.5 | GiteaGitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git… | Fix |
| CVE-2026-105111 | 6 Oct 2026 | CVSS 4.7 | Apache Software Foundation Apache Commons BCELImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when… | |
| CVE-2026-105239 | 6 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache log4netImproper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content… | Fix |
| CVE-2026-105240 | 6 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache log4netImproper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged… | Fix |
| CVE-2026-105241 | 6 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache log4netImproper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode… | Fix |
| CVE-2026-103008 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchUncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct… | |
| CVE-2026-103009 | 6 Oct 2026 | CVSS 7.1 | ElasticsearchAuthorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster… | |
| CVE-2026-103059 | 6 Oct 2026 | CVSS 9.1 | GiteaWhen Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its… | Fix |
| CVE-2026-103504 | 6 Oct 2026 | CVSS 8.1 | GiteaChanging an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the… | |
| CVE-2026-103667 | 6 Oct 2026 | CVSS 5.4 | GiteaGitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a… | Fix |
| CVE-2026-103670 | 6 Oct 2026 | CVSS 7.5 | GiteaWhen a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run… | Fix |
| CVE-2026-104047 | 6 Oct 2026 | CVSS 5.3 | Red Hat Enterprise Linux 10A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into… | |
| CVE-2026-104048 | 6 Oct 2026 | CVSS 8.1 | Red Hat Enterprise Linux 10A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping… | |
| CVE-2026-102410 | 6 Oct 2026 | CVSS 4.3 | Elastic KibanaMissing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1)… | |
| CVE-2026-102411 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchAllocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130)… | |
| CVE-2026-102412 | 6 Oct 2026 | CVSS 6.5 | Elastic KibanaIncorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs… | |
| CVE-2026-102413 | 6 Oct 2026 | CVSS 6.2 | Elastic Agent and Elastic DefendUncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic… | |
| CVE-2026-103005 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchMemory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An… | |
| CVE-2026-103006 | 6 Oct 2026 | CVSS 6.5 | ElasticsearchUncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the… |
Page 108 of 168