Total
1272 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-116471 | 2026-10-31 | 4.0 MEDIUM | 4.3 MEDIUM | ||
| A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-118086 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. | |||||
| CVE-2026-86935 | 1 Apple | 1 Macos | 2026-10-30 | N/A | 5.5 MEDIUM |
| This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access user-sensitive data. | |||||
| CVE-2026-119599 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists. | |||||
| CVE-2026-116386 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. | |||||
| CVE-2026-54854 | 2026-10-30 | N/A | 6.3 MEDIUM | ||
| Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | |||||
| CVE-2026-11861 | 2 Freeipa, Redhat | 2 Freeipa, Enterprise Linux | 2026-10-30 | N/A | 9.6 CRITICAL |
| A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain. | |||||
| CVE-2026-118082 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. | |||||
| CVE-2026-84807 | 2026-10-29 | N/A | 5.4 MEDIUM | ||
| Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0. | |||||
| CVE-2026-72826 | 2026-10-29 | N/A | 8.8 HIGH | ||
| The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE). | |||||
| CVE-2026-116106 | 2026-10-29 | 7.5 HIGH | 7.3 HIGH | ||
| A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-57144 | 2026-10-29 | N/A | 8.8 HIGH | ||
| PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61. | |||||
| CVE-2026-112407 | 2026-10-28 | N/A | 8.8 HIGH | ||
| Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later. | |||||
| CVE-2026-118644 | 2026-10-28 | N/A | 7.7 HIGH | ||
| n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets. | |||||
| CVE-2026-114249 | 2026-10-27 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2024-32507 | 2026-10-27 | N/A | 8.8 HIGH | ||
| Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.7.16. | |||||
| CVE-2025-10988 | 1 Iocoder | 1 Ruoyi-vue-pro | 2026-10-27 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor confirms: "The controllers check the relevant update permission and obtain the acting user ID from the authenticated server context. The services require CRM OWNER permission and call transferPermission, which explicitly rejects a caller who is neither the owner nor an authorized CRM administrator." | |||||
| CVE-2025-10987 | 1 Iocoder | 1 Yudao-cloud | 2026-10-27 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor confirms: "The controllers check the relevant update permission and obtain the acting user ID from the authenticated server context. The services require CRM OWNER permission and call transferPermission, which explicitly rejects a caller who is neither the owner nor an authorized CRM administrator." | |||||
| CVE-2025-10278 | 1 Iocoder | 1 Ruoyi-vue-pro | 2026-10-27 | 6.5 MEDIUM | 6.3 MEDIUM |
| A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used. You should upgrade the affected component. The vendor confirms: "[T]he current code already checks the functional update permission, uses the authenticated server-side user ID, requires CRM OWNER permission, and explicitly rejects non-owner transfers in the shared transfer service, except for authorized CRM administrators." | |||||
| CVE-2025-10277 | 1 Iocoder | 1 Yudao-cloud | 2026-10-27 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as 0f573e1d8e1a895e1bcbb7740ef75306412c3f9d (master-jdk17). It is best practice to apply a patch to resolve this issue. The vendor confirms: "[W]e have now added the missing per-record CRM WRITE permission check to submitReceivable, the path reported as CVE-2025-10277, in both Boot and Cloud master-jdk17. Possession of a functional submit permission alone no longer permits submission of a record for which the caller lacks CRM write access." | |||||