Total
729 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-42411 | 2026-10-25 | N/A | 8.1 HIGH | ||
| Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions. | |||||
| CVE-2026-49062 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7. | |||||
| CVE-2026-56243 | 2026-10-25 | N/A | 8.1 HIGH | ||
| Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources. | |||||
| CVE-2026-40790 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions. | |||||
| CVE-2026-40785 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions. | |||||
| CVE-2026-42378 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions. | |||||
| CVE-2026-42668 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions. | |||||
| CVE-2026-58172 | 2026-10-25 | N/A | 9.1 CRITICAL | ||
| Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list. | |||||
| CVE-2026-56029 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions. | |||||
| CVE-2026-12579 | 2026-10-25 | N/A | 7.4 HIGH | ||
| AS228T with Authentication Bypass Vulnerability | |||||
| CVE-2026-53576 | 1 Kestra | 1 Kestra | 2026-10-25 | N/A | 10.0 CRITICAL |
| Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21. | |||||
| CVE-2026-20460 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788. | |||||
| CVE-2026-20459 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01816800; Issue ID: MSV-6842. | |||||
| CVE-2026-58517 | 1 Mediawiki | 1 Mediawiki | 2026-10-25 | N/A | 4.3 MEDIUM |
| Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4. | |||||
| CVE-2026-57807 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8. | |||||
| CVE-2026-57697 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6. | |||||
| CVE-2026-57698 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12. | |||||
| CVE-2026-47481 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | |||||
| CVE-2026-57980 | 1 Microsoft | 1 Edge Chromium | 2026-10-24 | N/A | 5.4 MEDIUM |
| Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network. | |||||
| CVE-2026-39385 | 2026-10-24 | N/A | N/A | ||
| Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course. | |||||