Total
1272 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-9795 | 1 Redhat | 1 Build Of Keycloak | 2026-10-26 | N/A | 7.3 HIGH |
| A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm. | |||||
| CVE-2026-42731 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9. | |||||
| CVE-2026-45830 | 1 Trychroma | 1 Chromadb | 2026-10-26 | N/A | 8.8 HIGH |
| A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to. | |||||
| CVE-2026-54807 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions. | |||||
| CVE-2026-39546 | 2026-10-26 | N/A | 7.6 HIGH | ||
| Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. | |||||
| CVE-2026-49060 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4. | |||||
| CVE-2026-11336 | 2026-10-26 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboard_page/admin_page.php of the component Admin Interface. The manipulation of the argument UserAuthData leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-12289 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-26 | N/A | 8.8 HIGH |
| Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. | |||||
| CVE-2026-47169 | 2026-10-26 | N/A | N/A | ||
| Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitrary role to new members. If the selected role has Administrator and is below the bot’s highest role, the attacker can join with a controlled account and receive full server admin. This issue has been patched in version 1.0.3. | |||||
| CVE-2026-49058 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. | |||||
| CVE-2026-44173 | 1 Mariadb | 1 Mariadb | 2026-10-26 | N/A | 5.0 MEDIUM |
| MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2. | |||||
| CVE-2026-57386 | 2026-10-26 | N/A | 8.8 HIGH | ||
| Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks: from n/a before 2.9.1. | |||||
| CVE-2026-54196 | 2026-10-26 | N/A | 6.8 MEDIUM | ||
| Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1. | |||||
| CVE-2026-54805 | 2026-10-26 | N/A | 8.8 HIGH | ||
| Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. | |||||
| CVE-2026-7092 | 2026-10-26 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile Handler. Such manipulation of the argument ID leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2026-7109 | 2026-10-26 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. | |||||
| CVE-2026-7091 | 2026-10-26 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A flaw has been found in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /user of the component User Management Handler. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. | |||||
| CVE-2026-27407 | 2026-10-25 | N/A | 7.2 HIGH | ||
| Editor Privilege Escalation in AI Engine <= 3.4.9 versions. | |||||
| CVE-2026-12782 | 2026-10-25 | 6.8 MEDIUM | 7.8 HIGH | ||
| A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function in the library EUEDKEPM.sys of the component Kernel Driver. The manipulation results in improper access controls. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The affected component should be upgraded. The vendor explains: "We have confirmed that this issue was present only in older versions of the product. Our product has since been updated, and the issue has been resolved in the latest version, so it no longer exists." | |||||
| CVE-2026-48889 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Subscriber Privilege Escalation in Amelia <= 2.3 versions. | |||||