Total
4803 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-9056 | 1 Tecno | 1 Audiolink | 2026-10-14 | N/A | 5.3 MEDIUM |
| Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation. | |||||
| CVE-2026-9268 | 1 Gitlab | 1 Gitlab | 2026-10-14 | N/A | 2.7 LOW |
| GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks. | |||||
| CVE-2026-92528 | 1 Gitlab | 1 Gitlab | 2026-10-14 | N/A | 4.2 MEDIUM |
| GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution. | |||||
| CVE-2026-85529 | 1 Gitlab | 1 Gitlab | 2026-10-14 | N/A | 5.3 MEDIUM |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API. | |||||
| CVE-2026-16301 | 1 Gitlab | 1 Gitlab | 2026-10-14 | N/A | 8.5 HIGH |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service. | |||||
| CVE-2026-14552 | 1 Gitlab | 1 Gitlab | 2026-10-14 | N/A | 4.3 MEDIUM |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks. | |||||
| CVE-2026-4273 | 1 Mattermost | 1 Mattermost Server | 2026-10-14 | N/A | 3.7 LOW |
| Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575 | |||||
| CVE-2026-44330 | 1 Free5gc | 1 Free5gc | 2026-10-14 | N/A | 10.0 CRITICAL |
| free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2. | |||||
| CVE-2026-4286 | 1 Mattermost | 1 Mattermost Server | 2026-10-14 | N/A | 3.1 LOW |
| Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552 | |||||
| CVE-2026-6341 | 1 Mattermost | 1 Mattermost Server | 2026-10-14 | N/A | 4.3 MEDIUM |
| Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to have API-level checks on which groups the user can create issues or attach comments to which allows a user that is member of multiple groups to create issues to a locked group via direct API requests. Mattermost Advisory ID: MMSA-2026-00602 | |||||
| CVE-2026-9807 | 1 Gitlab | 1 Gitlab | 2026-10-14 | N/A | 4.3 MEDIUM |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed a blocked Project Access Token to continue accessing private resources due to incorrect authorization enforcement. | |||||
| CVE-2026-28759 | 1 Mattermost | 1 Mattermost Server | 2026-10-14 | N/A | 4.3 MEDIUM |
| Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576 | |||||
| CVE-2026-6343 | 1 Mattermost | 1 Mattermost Server | 2026-10-14 | N/A | 4.3 MEDIUM |
| Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591 | |||||
| CVE-2026-40914 | 1 Apache | 1 Artemis | 2026-10-14 | N/A | 4.3 MEDIUM |
| A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. A user could successfully send a message to an address or consume a message from a queue with a routing-type not supported by the corresponding address when that operation should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. Even though the user was already granted permission to send and/or consume messages, they should not be able to augment the routing-type of the address without the createAddress permission. This issue affects Apache Artemis: from 2.50.0 through 2.53.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.54.0, which fixes the issue. | |||||
| CVE-2026-6713 | 1 Gitlab | 1 Gitlab | 2026-10-14 | N/A | 5.3 MEDIUM |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an unauthorized user to enumerate private projects due to incorrect authorization checks. | |||||
| CVE-2026-28732 | 1 Mattermost | 1 Mattermost Server | 2026-10-14 | N/A | 4.3 MEDIUM |
| Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597 | |||||
| CVE-2026-6342 | 1 Mattermost | 1 Mattermost Server | 2026-10-14 | N/A | 4.3 MEDIUM |
| Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to appropriately check for valid namespaces which allows plugin users to create subscriptions to groups that were not whitelisted via creating groups that share the same prefix as a whitelisted group. Mattermost Advisory ID: MMSA-2026-00601 | |||||
| CVE-2026-102865 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | N/A | 6.5 MEDIUM |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | |||||
| CVE-2026-102862 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | N/A | 8.8 HIGH |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-105720 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | |||||