Total
412418 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-72669 | 1 Elastic | 1 Kibana | 2026-09-04 | N/A | 7.6 HIGH |
| The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error. | |||||
| CVE-2026-72657 | 1 Elastic | 1 Fleet Server | 2026-09-04 | N/A | 6.5 MEDIUM |
| Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to. | |||||
| CVE-2026-84666 | 2026-09-04 | N/A | 5.4 MEDIUM | ||
| Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings. | |||||
| CVE-2026-58566 | 2026-09-04 | N/A | 8.8 HIGH | ||
| Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. | |||||
| CVE-2026-72656 | 1 Elastic | 1 Elasticsearch | 2026-09-04 | N/A | 6.5 MEDIUM |
| Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable. | |||||
| CVE-2025-67034 | 1 Lantronix | 6 Eds5008, Eds5008 Firmware, Eds5016 and 3 more | 2026-09-04 | N/A | 7.2 HIGH |
| An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges. | |||||
| CVE-2023-20577 | 2026-09-04 | N/A | 7.4 HIGH | ||
| A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution. | |||||
| CVE-2023-20576 | 2026-09-04 | N/A | 7.7 HIGH | ||
| Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation. | |||||
| CVE-2026-72655 | 1 Elastic | 1 Kibana | 2026-09-04 | N/A | 4.3 MEDIUM |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view. | |||||
| CVE-2026-72648 | 1 Elastic | 1 Elastic Cloud On Kubernetes | 2026-09-04 | N/A | 6.5 MEDIUM |
| Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account token, the token is written into the generated workload specification in cleartext rather than being referenced from the Kubernetes Secret that ECK maintains for the other credentials on the same path. Any principal able to read workload specifications in the affected namespace can therefore read a live Elasticsearch credential, even when Kubernetes RBAC does not grant that principal access to Secrets. | |||||
| CVE-2026-52132 | 1 Ggml | 1 Llama.cpp | 2026-09-04 | N/A | 7.5 HIGH |
| llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST request to /rerank. | |||||
| CVE-2026-24252 | 2 Linux, Nvidia | 2 Linux Kernel, Nemo | 2026-09-04 | N/A | 7.8 HIGH |
| NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure. | |||||
| CVE-2026-47859 | 1 Vmware | 1 Spring Integration | 2026-09-04 | N/A | 5.4 MEDIUM |
| RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier | |||||
| CVE-2026-47857 | 1 Broadcom | 1 Reactor Core | 2026-09-04 | N/A | 5.9 MEDIUM |
| In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier | |||||
| CVE-2026-47856 | 1 Vmware | 1 Spring Integration | 2026-09-04 | N/A | 6.3 MEDIUM |
| Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier | |||||
| CVE-2026-47852 | 1 Vmware | 1 Spring Ai | 2026-09-04 | N/A | 7.5 HIGH |
| A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9 | |||||
| CVE-2026-47851 | 1 Vmware | 1 Spring Ai | 2026-09-04 | N/A | 7.5 HIGH |
| Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9 | |||||
| CVE-2026-47850 | 1 Vmware | 1 Spring Data Rest | 2026-09-04 | N/A | 4.3 MEDIUM |
| Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier | |||||
| CVE-2026-19766 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-04 | N/A | 9.6 CRITICAL |
| An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the AFC host. | |||||
| CVE-2026-22752 | 1 Broadcom | 1 Spring Authorization Server | 2026-09-04 | N/A | 9.6 CRITICAL |
| Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10. | |||||