Total
8761 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-28965 | 1 Apple | 2 Ipados, Iphone Os | 2026-10-26 | N/A | 7.5 HIGH |
| A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the lock screen. | |||||
| CVE-2026-40420 | 1 Microsoft | 3 365 Apps, Office, Office Long Term Servicing Channel | 2026-10-26 | N/A | 8.8 HIGH |
| Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-40381 | 1 Microsoft | 1 Azure Connected Machine Agent | 2026-10-26 | N/A | 7.8 HIGH |
| Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-44277 | 1 Fortinet | 1 Fortiauthenticator | 2026-10-26 | N/A | 9.8 CRITICAL |
| A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests. | |||||
| CVE-2026-42832 | 1 Microsoft | 4 Excel, Office, Office Long Term Servicing Channel and 1 more | 2026-10-26 | N/A | 7.7 HIGH |
| Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally. | |||||
| CVE-2026-28978 | 1 Apple | 1 Macos | 2026-10-26 | N/A | 8.8 HIGH |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox. | |||||
| CVE-2026-7813 | 1 Pgadmin | 1 Pgadmin 4 | 2026-10-26 | N/A | 9.9 CRITICAL |
| Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs. Additionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner's process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) were writable by non-owners through the API, and additional fields (kerberos_conn, tags, post_connection_sql) lacked per-user persistence so non-owner edits mutated the owner's record. Fix centralises access control via a new server_access module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connection_manager when access is denied in server mode, suppresses owner-only fields for non-owners across the merge / API response / ServerManager paths, and adds an explicit owner-only write guard. The remediation landed in two pull requests; both are referenced. This issue affects pgAdmin 4: before 9.15. | |||||
| CVE-2026-41614 | 1 Microsoft | 1 365 Copilot | 2026-10-26 | N/A | 6.2 MEDIUM |
| Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally. | |||||
| CVE-2026-116108 | 2026-10-26 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-44874 | 1 Arubanetworks | 1 Arubaos | 2026-10-26 | N/A | 4.9 MEDIUM |
| A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability could result in the disclosure of confidential system information, potentially enabling further attacks against the affected device. | |||||
| CVE-2026-44007 | 1 Vm2 Project | 1 Vm2 | 2026-10-26 | N/A | 9.1 CRITICAL |
| vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1. | |||||
| CVE-2026-95704 | 2026-10-26 | N/A | 7.2 HIGH | ||
| A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security. | |||||
| CVE-2026-8545 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-10-26 | N/A | 3.1 LOW |
| Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-7373 | 2026-10-26 | N/A | N/A | ||
| Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access. | |||||
| CVE-2026-8586 | 1 Google | 1 Chrome | 2026-10-26 | N/A | 5.5 MEDIUM |
| Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium) | |||||
| CVE-2026-28374 | 1 Grafana | 1 Grafana | 2026-10-26 | N/A | 4.3 MEDIUM |
| Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. | |||||
| CVE-2026-33381 | 1 Grafana | 1 Grafana | 2026-10-26 | N/A | 5.9 MEDIUM |
| When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. | |||||
| CVE-2026-8556 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-26 | N/A | 3.1 LOW |
| Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-33377 | 1 Grafana | 1 Grafana | 2026-10-26 | N/A | 7.1 HIGH |
| An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. | |||||
| CVE-2026-113674 | 2026-10-26 | N/A | 3.7 LOW | ||
| The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled. | |||||