Total
3324 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-74771 | 1 Dell | 1 Powerprotect One | 2026-08-28 | N/A | 6.5 MEDIUM |
| Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering. | |||||
| CVE-2026-81299 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions. | |||||
| CVE-2026-3235 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership). | |||||
| CVE-2026-16567 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs. | |||||
| CVE-2026-78139 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications. | |||||
| CVE-2026-16568 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles. | |||||
| CVE-2026-79615 | 2026-08-28 | N/A | 2.7 LOW | ||
| The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users. | |||||
| CVE-2026-79995 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's. | |||||
| CVE-2023-43900 | 1 Emudhra | 1 Emsigner | 2026-08-28 | N/A | 6.5 MEDIUM |
| Insecure Direct Object References (IDOR) in eMudhra emSigner v2.8.7 allow authenticated attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters. | |||||
| CVE-2026-77035 | 2026-08-28 | N/A | N/A | ||
| Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record. | |||||
| CVE-2026-77990 | 2026-08-28 | N/A | N/A | ||
| Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events. | |||||
| CVE-2026-81817 | 2026-08-28 | N/A | N/A | ||
| Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task. The patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints. The fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths. Version impacted =>3.3.0 | |||||
| CVE-2026-17562 | 2026-08-28 | N/A | 6.5 MEDIUM | ||
| Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0. | |||||
| CVE-2026-76263 | 1 Splunk | 1 Splunk | 2026-08-26 | N/A | 5.4 MEDIUM |
| In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 (SPL2) modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk Enterprise versions below 10.2. The broken object level authorization is possible because the data management orchestrator does not verify that the requesting user owns the target resources before it deletes the modules. For more information see Manage SPL2-based apps (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/meet-splunk-apps/manage-spl2-based-apps) in the Splunk documentation. | |||||
| CVE-2026-77127 | 2026-08-26 | N/A | N/A | ||
| The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the requested field, leading to disclosure of sensitive information such as backend and frontend user password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extensions backend module. | |||||
| CVE-2026-71251 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs. | |||||
| CVE-2026-57886 | 2026-08-26 | N/A | 5.9 MEDIUM | ||
| Cross-repository issue/comment attachment re-linking can expose private attachment content | |||||
| CVE-2026-58445 | 2026-08-26 | N/A | 2.7 LOW | ||
| Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | |||||
| CVE-2026-58432 | 2026-08-26 | N/A | 5.9 MEDIUM | ||
| Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | |||||
| CVE-2026-58435 | 2026-08-26 | N/A | 5.4 MEDIUM | ||
| Gitea LFS Deploy-Key Privilege Escalation | |||||