GitLab Enterprise Edition versions from 15.6 up to but not including 19.0.6, 19.1 up to 19.1.4, and 19.2 up to 19.2.2 contain an incorrect privilege assignment vulnerability. This flaw could allow a user with a pending membership status to receive permissions granted by a custom role, due to the system not properly accounting for membership state. The issue has been remediated in versions 19.0.6, 19.1.4, and 19.2.2 and later.
Distribution versions prior to 3.1.1 contain a vulnerability where tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled configuration. This allows API clients to delete tags even when deletion is explicitly disabled by the operator. The issue is fixed in version 3.1.1.
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.
WordPress versions prior to 7.0.4 are vulnerable to a remote code execution vulnerability via malicious Postscript file uploads by users with Author level or higher privileges. This vulnerability requires the server to have Imagick and Ghostscript installed and a user with the 'upload_files' capability. WordPress 7.0.4 and all maintained older branches back to 4.7 include a fix for this issue.
A high-severity vulnerability (CVE-2026-62574) affects multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in the Install component. The vulnerability allows a low-privileged attacker with access to the infrastructure to potentially take over the affected products. The CVSS 3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this vulnerability in their July and August 2026 Critical Patch Updates. Users are strongly advised to apply these patches promptly to mitigate risk.
Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2 contain an uncontrolled resource consumption vulnerability in the Connect CA roots endpoint. This flaw allows a remote caller to cause the agent's Connect CA roots cache to grow without limit, bypassing the operator's cache-disable configuration. The issue is resolved in Consul 2.0.3 and Consul Enterprise versions 1.21.17, 1.22.11, and 2.0.3.
Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 contain an uncontrolled resource consumption vulnerability in the Connect authorization endpoint. This flaw allows an attacker to increase the agent's intention-match cache size without limit, bypassing the operator's cache-disable settings. The issue is addressed in Consul 2.0.3 and later versions of Consul Enterprise including 1.21.17, 1.22.11, and 2.0.3.
Consul Community Edition and Consul Enterprise versions 1.18.0 through 2.0.2 contain an authenticated denial of service vulnerability in the Enterprise-to-Community Edition downgrade path. An authorized user with config-entry write permission can submit a specially crafted service-router configuration entry that causes the Consul agent to exit unexpectedly, crashing the server. This issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
CVE-2026-50523 is a command injection vulnerability in Microsoft PowerShell 7.4 that allows an authorized local attacker to execute arbitrary code by exploiting improper neutralization of special elements in commands. It affects multiple versions in the 7.4.x, 7.5.x, and 7.6.x series prior to patched releases. The vulnerability has a high severity score of 7.8 and impacts confidentiality, integrity, and availability. An official fix is available to remediate this issue.
CVE-2026-33818 is a high-severity denial-of-service vulnerability in the Go standard library's encoding/asn1 component. It allows an attacker to cause uncontrolled resource consumption via malformed inputs, leading to denial of service. Red Hat has released updated Hardened Images RPMs containing patched versions of Go 1.25.13 to remediate this and related issues. The vulnerability affects various Red Hat products that include these Go components. No known exploits are reported in the wild.
A denial of service vulnerability exists in Apache Thrift Java bindings (libthrift-java) due to uncontrolled resource allocation. This issue is addressed in a security update released by Red Hat for their Build of Apache Camel 4.18 for Quarkus 3.33. The vulnerability can cause service disruption but does not impact confidentiality or integrity. The update is rated as important and recommended for affected users.
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Vault Secrets Operator versions 1.3.0 through 1.4.1 contain a vulnerability in the AppRole authentication configuration that allows tenants with limited Kubernetes RBAC permissions to read arbitrary files from the operator pod's filesystem and exfiltrate credentials. This can lead to privilege escalation within the Kubernetes cluster. The issue is fixed in version 1.5.0.
Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.