NVD Vulnerabilities

Severity Distribution

Publication Trend

Vulnerability Database

CVE ID Description Published Base Score Attack Vector Severity Actions
CVE-2026-103670 When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run sti... 2026-10-06 7.5 NETWORK HIGH NVD
CVE-2026-103667 Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Conten... 2026-10-06 5.4 NETWORK MEDIUM NVD
CVE-2026-103504 Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the reques... 2026-10-06 8.1 NETWORK HIGH NVD
CVE-2026-103059 When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its e... 2026-10-06 9.1 NETWORK CRITICAL NVD
CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster s... 2026-10-06 7.1 NETWORK HIGH NVD
CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct an... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-103007 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully ... 2026-10-06 7.2 NETWORK HIGH NVD
CVE-2026-103006 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggreg... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenti... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-102413 Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoi... 2026-10-06 6.2 LOCAL MEDIUM NVD
CVE-2026-102412 Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs ... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-102411 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). El... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-102410 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A... 2026-10-06 4.3 NETWORK MEDIUM NVD
CVE-2026-102409 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-102408 Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-4... 2026-10-06 4.3 NETWORK MEDIUM NVD