Total
1272 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-12786 | 2026-10-25 | 6.8 MEDIUM | 7.8 HIGH | ||
| A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown functionality in the library bootpt64.sys of the component Kernel Driver. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-12784 | 2026-10-25 | 6.8 MEDIUM | 7.8 HIGH | ||
| A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the library MDA_NTDRV.sys of the component Kernel Driver. This manipulation causes improper access controls. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-49111 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0. | |||||
| CVE-2026-39587 | 2026-10-25 | N/A | 8.1 HIGH | ||
| Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions. | |||||
| CVE-2026-39583 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions. | |||||
| CVE-2026-12823 | 2026-10-25 | 1.7 LOW | 3.3 LOW | ||
| A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The first version of the CVE listed Browserbase itself as affected product. This was incorrect as this issue does affect browserbase/skills instead. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-39579 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Contributor Privilege Escalation in B Blocks <= 2.0.31 versions. | |||||
| CVE-2026-49063 | 2026-10-25 | N/A | 7.3 HIGH | ||
| Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions. | |||||
| CVE-2026-12770 | 1 Litellm | 1 Litellm | 2026-10-25 | 5.5 MEDIUM | 5.4 MEDIUM |
| A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 23781. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-12781 | 2026-10-25 | 6.8 MEDIUM | 7.8 HIGH | ||
| A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the library epmntdrv.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit is publicly available and might be used. You should upgrade the affected component. The vendor explains: "We have confirmed that this issue was present only in older versions of the product. Our product has since been updated, and the issue has been resolved in the latest version, so it no longer exists." | |||||
| CVE-2026-12771 | 1 Litellm | 1 Litellm | 2026-10-25 | 4.6 MEDIUM | 5.0 MEDIUM |
| A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-12780 | 2026-10-25 | 6.8 MEDIUM | 7.8 HIGH | ||
| A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-34901 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. | |||||
| CVE-2026-12778 | 2026-10-25 | 6.8 MEDIUM | 7.8 HIGH | ||
| A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in the library ampa10.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-49780 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Customer Privilege Escalation in Dokan <= 5.0.2 versions. | |||||
| CVE-2026-12164 | 1 Fortra | 1 File Integrity Monitoring | 2026-10-25 | N/A | 4.4 MEDIUM |
| Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships. | |||||
| CVE-2026-12779 | 2026-10-25 | 6.8 MEDIUM | 7.8 HIGH | ||
| A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unknown processing in the library ddmdrv.sys of the component Kernel Driver. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-12799 | 1 Litellm | 1 Litellm | 2026-10-25 | 4.0 MEDIUM | 4.3 MEDIUM |
| A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-13568 | 2026-10-25 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-13591 | 2026-10-25 | 4.6 MEDIUM | 5.0 MEDIUM | ||
| A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/managers/ChannelBridge.ts of the component Contact Tracking. This manipulation of the argument _channelType causes improper authorization. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48. It is suggested to install a patch to address this issue. | |||||