Total
1273 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-16199 | 2026-10-24 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed_exec.go. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. | |||||
| CVE-2026-16121 | 2026-10-24 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-21824 | 2026-10-24 | N/A | 8.8 HIGH | ||
| HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. | |||||
| CVE-2026-16224 | 2026-10-24 | 4.0 MEDIUM | 4.3 MEDIUM | ||
| A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component Application API. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The identifier of the patch is dc2b6910a423b3bfadeffaa303e1ba75cfb33900. Applying a patch is the recommended action to fix this issue. | |||||
| CVE-2026-47237 | 2026-10-24 | N/A | 8.0 HIGH | ||
| Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user's account and the data that is processed by that user. The attacker needs a valid user with the ``kubeflow-edit`` role / Contributor role in a random Kubeflow namespace to perform this attack. This is given if _Automatic Profile Creation_ is enabled. Version 26.03-rc.1 fixes the issue. | |||||
| CVE-2026-65507 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. | |||||
| CVE-2026-64639 | 2026-10-24 | N/A | N/A | ||
| Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator. | |||||
| CVE-2026-66662 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. | |||||
| CVE-2026-66661 | 2026-10-24 | N/A | 7.7 HIGH | ||
| Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions. | |||||
| CVE-2026-61979 | 2026-10-24 | N/A | 8.1 HIGH | ||
| Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. | |||||
| CVE-2026-66424 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions. | |||||
| CVE-2026-65559 | 2026-10-24 | N/A | 7.2 HIGH | ||
| Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions. | |||||
| CVE-2026-71468 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure. | |||||
| CVE-2026-59540 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions. | |||||
| CVE-2026-16764 | 2026-10-24 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue. The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed. | |||||
| CVE-2026-27668 | 2026-10-24 | N/A | 8.8 HIGH | ||
| A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access to any device group at any access level. | |||||
| CVE-2026-53847 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 5.4 MEDIUM |
| OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficient scope validation to apply unauthorized configuration changes beyond the intended write scope. | |||||
| CVE-2026-17434 | 2026-10-24 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue. | |||||
| CVE-2026-17433 | 2026-10-24 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-39470 | 2026-10-24 | N/A | 7.2 HIGH | ||
| Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions. | |||||