NVD Vulnerabilities

Severity Distribution

Publication Trend

Vulnerability Database

CVE ID Description Published Base Score Attack Vector Severity Actions
CVE-2026-104632 Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only... 2026-10-06 8.8 NETWORK HIGH NVD
CVE-2026-104626 A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting... 2026-10-06 8.8 NETWORK HIGH NVD
CVE-2026-104048 A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain... 2026-10-06 6.8 NETWORK MEDIUM NVD
CVE-2026-104047 A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory... 2026-10-06 5.3 LOCAL MEDIUM NVD
CVE-2026-103670 When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run sti... 2026-10-06 7.5 NETWORK HIGH NVD
CVE-2026-103667 Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Conten... 2026-10-06 5.4 NETWORK MEDIUM NVD
CVE-2026-103504 Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the reques... 2026-10-06 8.1 NETWORK HIGH NVD
CVE-2026-103059 When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its e... 2026-10-06 9.1 NETWORK CRITICAL NVD
CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster s... 2026-10-06 7.1 NETWORK HIGH NVD
CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct an... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-103007 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully ... 2026-10-06 7.2 NETWORK HIGH NVD
CVE-2026-103006 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggreg... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenti... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-102413 Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoi... 2026-10-06 6.2 LOCAL MEDIUM NVD
CVE-2026-102412 Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs ... 2026-10-06 6.5 NETWORK MEDIUM NVD