Total
1273 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-68568 | 2026-10-22 | N/A | 6.3 MEDIUM | ||
| Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions. | |||||
| CVE-2026-75978 | 2026-10-22 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-112242 | 2026-10-22 | N/A | 8.8 HIGH | ||
| Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4. | |||||
| CVE-2020-25720 | 2026-10-21 | N/A | 7.5 HIGH | ||
| A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks. | |||||
| CVE-2026-114245 | 2026-10-21 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-8743 | 1 Open5gs | 1 Open5gs | 2026-10-21 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MME. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 5746b8576cfceec18ed87eb7d8cf11b1fb4cd8b1. It is suggested to install a patch to address this issue. | |||||
| CVE-2026-101144 | 2026-10-20 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-11554 | 1 Portabilis | 1 I-educar | 2026-10-20 | 6.5 MEDIUM | 6.3 MEDIUM |
| A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 can resolve this issue. The identifier of the patch is d53365e5656f6499a4deddf89d522814655f769d. It is advisable to upgrade the affected component. | |||||
| CVE-2025-10071 | 1 Portabilis | 1 I-educar | 2026-10-20 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 2.12 is able to resolve this issue. The name of the patch is d53365e5656f6499a4deddf89d522814655f769d. The affected component should be upgraded. | |||||
| CVE-2025-10070 | 1 Portabilis | 1 I-educar | 2026-10-20 | 6.5 MEDIUM | 6.3 MEDIUM |
| A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 2.12 is able to mitigate this issue. Patch name: d53365e5656f6499a4deddf89d522814655f769d. You should upgrade the affected component. | |||||
| CVE-2025-10013 | 1 Portabilis | 1 I-educar | 2026-10-20 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.12 mitigates this issue. The patch is named d53365e5656f6499a4deddf89d522814655f769d. You should upgrade the affected component. | |||||
| CVE-2026-86830 | 2026-10-20 | N/A | 7.2 HIGH | ||
| Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment. This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. | |||||
| CVE-2026-110373 | 2026-10-19 | N/A | 8.1 HIGH | ||
| Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77. | |||||
| CVE-2026-110372 | 2026-10-19 | N/A | 9.8 CRITICAL | ||
| Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. | |||||
| CVE-2026-112045 | 2026-10-19 | 5.5 MEDIUM | 5.4 MEDIUM | ||
| A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability." | |||||
| CVE-2026-112025 | 2026-10-19 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-110898 | 2026-10-19 | N/A | 6.4 MEDIUM | ||
| Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5. | |||||
| CVE-2025-10389 | 1 Crmeb | 1 Crmeb | 2026-10-19 | 5.5 MEDIUM | 5.4 MEDIUM |
| A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the component Administrator Password Handler. Performing manipulation of the argument ID results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-10319 | 1 Jeecg | 1 Jeecg Boot | 2026-10-19 | 4.0 MEDIUM | 4.3 MEDIUM |
| A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the component Tenant Log Export. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-10390 | 1 Crmeb | 1 Crmeb | 2026-10-19 | 5.5 MEDIUM | 5.4 MEDIUM |
| A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Executing manipulation of the argument ID can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. | |||||