CVE-2026-87701

Azure Cosmos DB Elevation of Privilege Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cosmos Db Cosmos Db

CVE-2026-63493

Snipe-IT: 2FA bypass via the API token flow

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Grokability Snipeitapp

Products

Snipe-it Snipe-it

CVE-2026-71898

Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Dolphinscheduler

CVE-2026-102570

ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Clip-bucket Macwarrior

Products

Clipbucket Clipbucket-v5

CVE-2026-88060

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Angular

Products

Angular

CVE-2026-94396

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-82294

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-82300

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-65112

Uncontrolled Resource Consumption Leading to Denial of Service in NVIDIA Infrastructure Controller

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-96651

Plex Media Server path traversal

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Plex

Products

Media Server

CVE-2026-65113

Hard‑Coded Credentials in NVIDIA Infrastructure Controller Allow Privilege Escalation

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65114

Authentication Bypass in NVIDIA Infrastructure Controller for Linux

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65115

Resource Exhaustion Leading to Denial of Service in NVIDIA Infrastructure Controller for Linux

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successful exploit of this vulnerability may lead to denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65117

Hard‑Coded Password in NVIDIA Infrastructure Controller Allows Unauthorized Access

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65118

Improper Certificate Validation in NVIDIA Infrastructure Controller for Linux Enabling Disclosure, Tampering, and Denial of Service

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65121

Improper Authentication Allows Privilege Escalation and Data Tampering in NVIDIA Infrastructure Controller

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-69365

Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 12 more

CVE-2026-65124

XML Injection Vulnerability in NVIDIA Infrastructure Controller for Linux

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65125

Path Traversal Allowing External File Control in NVIDIA Infrastructure Controller

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-65126

Improper Workflow Enforcement Leads to Data Tampering and DoS

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller