Total
8762 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-48948 | 1 Joomla | 1 Joomla\! | 2026-10-25 | N/A | 8.8 HIGH |
| An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. | |||||
| CVE-2026-48955 | 1 Joomla | 1 Joomla\! | 2026-10-25 | N/A | 6.5 MEDIUM |
| An improper access check allows unauthorized users to access workflow stage and transition information. | |||||
| CVE-2026-48958 | 1 Joomla | 1 Joomla\! | 2026-10-25 | N/A | 8.8 HIGH |
| An improper access check allows unauthorized users to create custom fields via webservices endpoints. | |||||
| CVE-2026-48947 | 1 Joomla | 1 Joomla\! | 2026-10-25 | N/A | 4.9 MEDIUM |
| An improper access check allows privileged users to overwrite media files without editing permissions. | |||||
| CVE-2026-56217 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions table via PostgREST to clear session_key and key_id fields, bypassing organization-enforced encrypted-bundle policies and weakening OTA security controls. | |||||
| CVE-2026-48957 | 1 Joomla | 1 Joomla\! | 2026-10-25 | N/A | 8.8 HIGH |
| An improper access check allows unauthorized users to access com_privacy datasets. | |||||
| CVE-2026-14156 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 6.5 MEDIUM |
| Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-14155 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 6.5 MEDIUM |
| Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-13553 | 2026-10-25 | 7.5 HIGH | 7.3 HIGH | ||
| A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown function of the file /admin/mod_amenities/controller.php?action=add. Executing a manipulation of the argument image can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. | |||||
| CVE-2026-56823 | 2026-10-25 | N/A | 5.4 MEDIUM | ||
| AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the `POST /api/integrations/webhooks/{webhook_id}/ping` endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the authenticated user. Any authenticated user can supply an arbitrary webhook_id to confirm webhook existence, leak the webhook's OAuth provider type, and in some cases trigger a ping delivery on behalf of another user. This vulnerability is fixed in . | |||||
| CVE-2026-13818 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-48529 | 2026-10-25 | N/A | 6.0 MEDIUM | ||
| GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2. | |||||
| CVE-2026-13800 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-25 | N/A | 7.8 HIGH |
| Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High) | |||||
| CVE-2026-15188 | 2026-10-25 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the function EditEmployeeProfileAPIView of the file accounts/api/views.py of the component Employee Dashboard Endpoint. This manipulation of the argument role causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-58525 | 1 Microsoft | 1 Edge Chromium | 2026-10-25 | N/A | 8.2 HIGH |
| Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-13544 | 2026-10-25 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-13547 | 2026-10-25 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was determined in Hanwang e-Face General Management Platform 6.3.5.4. This issue affects some unknown processing of the file /manage/resourceUpload/upload.do. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2026-14775 | 2026-10-25 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesson.php. Such manipulation of the argument user_id leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the affected product appears to have a typo in it. | |||||
| CVE-2026-27779 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation. | |||||
| CVE-2026-14777 | 2026-10-25 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this issue is some unknown functionality of the file /announcements.php. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The name of the affected product appears to have a typo in it. | |||||