Total
3314 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-94180 | 2026-10-02 | N/A | 4.3 MEDIUM | ||
| Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26. | |||||
| CVE-2026-79654 | 2026-10-02 | N/A | 4.3 MEDIUM | ||
| A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps. | |||||
| CVE-2026-39444 | 2026-10-02 | N/A | 5.4 MEDIUM | ||
| Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3. | |||||
| CVE-2026-100272 | 1 Jetbrains | 1 Youtrack | 2026-10-02 | N/A | 4.9 MEDIUM |
| In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues | |||||
| CVE-2026-94405 | 2026-10-02 | N/A | 5.3 MEDIUM | ||
| Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71. | |||||
| CVE-2026-102876 | 2026-10-02 | N/A | 8.1 HIGH | ||
| SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries. | |||||
| CVE-2026-100514 | 2026-10-01 | N/A | 7.5 HIGH | ||
| Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions. | |||||
| CVE-2026-97251 | 2026-10-01 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions. | |||||
| CVE-2026-97269 | 2026-10-01 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions. | |||||
| CVE-2026-64948 | 2026-10-01 | N/A | N/A | ||
| Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards. | |||||
| CVE-2026-103247 | 2026-10-01 | N/A | 8.5 HIGH | ||
| n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts. | |||||
| CVE-2026-103476 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks. | |||||
| CVE-2026-102373 | 2026-10-01 | N/A | 6.5 MEDIUM | ||
| GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks. | |||||
| CVE-2026-100268 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 7.7 HIGH |
| In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates | |||||
| CVE-2026-103288 | 2026-10-01 | N/A | 6.5 MEDIUM | ||
| Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data. | |||||
| CVE-2026-102382 | 2026-10-01 | N/A | 4.3 MEDIUM | ||
| Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0. | |||||
| CVE-2026-62061 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2. | |||||
| CVE-2026-103491 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues | |||||
| CVE-2026-103496 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 5.4 MEDIUM |
| In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications | |||||
| CVE-2026-103252 | 2026-10-01 | N/A | 7.7 HIGH | ||
| n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration. | |||||