CVE-2026-94396

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-82294

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-82300

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-65112

Uncontrolled Resource Consumption Leading to Denial of Service in NVIDIA Infrastructure Controller

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-96651

Plex Media Server path traversal

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Plex

Products

Media Server

CVE-2026-65113

Hard‑Coded Credentials in NVIDIA Infrastructure Controller Allow Privilege Escalation

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65114

Authentication Bypass in NVIDIA Infrastructure Controller for Linux

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65115

Resource Exhaustion Leading to Denial of Service in NVIDIA Infrastructure Controller for Linux

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successful exploit of this vulnerability may lead to denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65117

Hard‑Coded Password in NVIDIA Infrastructure Controller Allows Unauthorized Access

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65118

Improper Certificate Validation in NVIDIA Infrastructure Controller for Linux Enabling Disclosure, Tampering, and Denial of Service

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65121

Improper Authentication Allows Privilege Escalation and Data Tampering in NVIDIA Infrastructure Controller

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-69365

Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 12 more

CVE-2026-65124

XML Injection Vulnerability in NVIDIA Infrastructure Controller for Linux

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65125

Path Traversal Allowing External File Control in NVIDIA Infrastructure Controller

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65126

Improper Workflow Enforcement Leads to Data Tampering and DoS

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-97897

Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Krayin

Products

Laravel-crm

CVE-2026-71483

Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Horilla

Products

Horilla

CVE-2026-57443

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=["*"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Issdandavis

Products

Scbe-aethermoore

CVE-2026-55214

GLPI: Stored XSS in suppliers

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-53610

GLPI: Reflected XSS in dashboards

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi