Total
1274 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-105382 | 2026-10-06 | 7.5 HIGH | 7.3 HIGH | ||
| A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument user_id causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-105284 | 2026-10-06 | 10.0 HIGH | 10.0 CRITICAL | ||
| A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-104405 | 2026-10-06 | N/A | 8.1 HIGH | ||
| Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. | |||||
| CVE-2026-39753 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions. | |||||
| CVE-2026-39761 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions. | |||||
| CVE-2026-105070 | 2026-10-06 | N/A | 8.8 HIGH | ||
| Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. | |||||
| CVE-2026-39774 | 2026-10-06 | N/A | 8.8 HIGH | ||
| Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions. | |||||
| CVE-2026-48197 | 2026-10-06 | N/A | 7.2 HIGH | ||
| Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0. | |||||
| CVE-2026-39775 | 2026-10-06 | N/A | 8.8 HIGH | ||
| Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions. | |||||
| CVE-2026-39773 | 2026-10-06 | N/A | 10.0 CRITICAL | ||
| Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions. | |||||
| CVE-2026-104757 | 2026-10-06 | N/A | 7.2 HIGH | ||
| Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions. | |||||
| CVE-2026-105058 | 2026-10-06 | N/A | 8.8 HIGH | ||
| Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. | |||||
| CVE-2026-39765 | 2026-10-06 | N/A | 7.2 HIGH | ||
| Shop Manager Privilege Escalation in Challan <= 3.7.88 versions. | |||||
| CVE-2026-105621 | 2026-10-06 | 5.5 MEDIUM | 5.4 MEDIUM | ||
| A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-105610 | 2026-10-06 | 5.8 MEDIUM | 4.7 MEDIUM | ||
| A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument initPassword results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-103534 | 2026-10-06 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded. | |||||
| CVE-2026-97324 | 2026-10-05 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback Handler. The manipulation of the argument ID leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-64188 | 2026-10-05 | N/A | 9.8 CRITICAL | ||
| Incorrect Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad: from n/a through <= 8.6.9. | |||||
| CVE-2025-58841 | 2026-10-05 | N/A | 5.5 MEDIUM | ||
| Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a through <= 1.0.4. | |||||
| CVE-2025-15689 | 2026-10-05 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions. | |||||