Total
1153 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-21756 | 2026-08-28 | N/A | 7.2 HIGH | ||
| HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments. | |||||
| CVE-2026-78271 | 2026-08-28 | N/A | 7.2 HIGH | ||
| Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions. | |||||
| CVE-2026-32566 | 2026-08-28 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | |||||
| CVE-2026-78267 | 2026-08-27 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions. | |||||
| CVE-2026-78158 | 2026-08-27 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. | |||||
| CVE-2026-15467 | 2026-08-27 | N/A | 8.1 HIGH | ||
| A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster. | |||||
| CVE-2026-15218 | 2026-08-27 | N/A | 7.9 HIGH | ||
| A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster. | |||||
| CVE-2026-78115 | 2026-08-26 | 5.5 MEDIUM | 5.4 MEDIUM | ||
| A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2026-58435 | 2026-08-26 | N/A | 5.4 MEDIUM | ||
| Gitea LFS Deploy-Key Privilege Escalation | |||||
| CVE-2026-32561 | 2026-08-26 | N/A | 8.8 HIGH | ||
| Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions. | |||||
| CVE-2026-75910 | 2026-08-25 | N/A | 6.5 MEDIUM | ||
| Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint. To remediate this issue, users should upgrade to aws-athena-query-federation connectors version v2026.17.1 or later and ensure that any forked or derivative code is patched to incorporate the new fixes. Alternatively, to remediate this issue, users should redeploy the connector with the current template and supply a non-empty SecretNamePrefix value. | |||||
| CVE-2026-77036 | 2026-08-25 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-11861 | 2 Freeipa, Redhat | 2 Freeipa, Enterprise Linux | 2026-08-24 | N/A | 9.6 CRITICAL |
| A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain. | |||||
| CVE-2026-77686 | 2026-08-24 | 5.5 MEDIUM | 5.4 MEDIUM | ||
| A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 24.0.0 is able to mitigate this issue. Patch name: b2a2c995537cb6282383b5e903cb5ffa29b823e6. The affected component should be upgraded. | |||||
| CVE-2026-77795 | 2026-08-24 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. The attack can be launched remotely. | |||||
| CVE-2026-28165 | 2026-08-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Digits <= 9.2 versions. | |||||
| CVE-2026-76999 | 2026-08-24 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in improper authorization. The attack can be initiated remotely. | |||||
| CVE-2026-66648 | 2026-08-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions. | |||||
| CVE-2026-32558 | 2026-08-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions. | |||||
| CVE-2026-75978 | 2026-08-21 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||