Total
9919 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-57921 | 1 Jetbrains | 1 Youtrack | 2026-06-27 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint | |||||
| CVE-2026-57922 | 1 Jetbrains | 1 Youtrack | 2026-06-27 | N/A | 3.1 LOW |
| In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible | |||||
| CVE-2026-57923 | 1 Jetbrains | 1 Youtrack | 2026-06-27 | N/A | 5.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings | |||||
| CVE-2026-57925 | 1 Jetbrains | 1 Youtrack | 2026-06-27 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags | |||||
| CVE-2026-55838 | 2026-06-27 | N/A | 4.3 MEDIUM | ||
| RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validate_admin_request to enforce admin-action IAM checks; the MetricsHandler skips this call entirely. A restricted IAM user whose policy grants only access to their own bucket can read server-wide operational metrics including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state. | |||||
| CVE-2026-55188 | 2026-06-27 | N/A | 8.2 HIGH | ||
| RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket. Because the returned BucketTarget objects include remote target credentials, this can disclose replication access keys and secret keys. This vulnerability is fixed in 1.0.0-beta.9. | |||||
| CVE-2026-44734 | 2026-06-27 | N/A | 6.5 MEDIUM | ||
| OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or permission level. An attacker who discovers or guesses a public report's numeric ID can rename or overwrite its filter configuration without any warning to the report's owner. This vulnerability is fixed in 17.3.2 and 17.4.0. | |||||
| CVE-2026-57661 | 2026-06-26 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions. | |||||
| CVE-2026-57649 | 2026-06-26 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions. | |||||
| CVE-2026-54837 | 2026-06-26 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions. | |||||
| CVE-2026-24547 | 2026-06-26 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions. | |||||
| CVE-2026-47193 | 2026-06-26 | N/A | 7.5 HIGH | ||
| OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1. | |||||
| CVE-2026-57285 | 1 Jenkins | 1 Github Branch Source | 2026-06-26 | N/A | 4.3 MEDIUM |
| A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration. | |||||
| CVE-2026-57286 | 1 Jenkins | 1 Git Parameter | 2026-06-26 | N/A | 4.3 MEDIUM |
| A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata. | |||||
| CVE-2026-57294 | 1 Jenkins | 1 Ec2 Fleet | 2026-06-26 | N/A | 5.4 MEDIUM |
| A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. | |||||
| CVE-2026-57300 | 1 Jenkins | 1 Mcp Server | 2026-06-26 | N/A | 4.3 MEDIUM |
| A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. | |||||
| CVE-2026-57307 | 1 Jenkins | 1 Zowe Zdevops | 2026-06-26 | N/A | 4.2 MEDIUM |
| A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2026-54027 | 1 Librechat | 1 Librechat | 2026-06-26 | N/A | 6.5 MEDIUM |
| LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1. | |||||
| CVE-2026-2238 | 1 Gitlab | 1 Gitlab | 2026-06-26 | N/A | 5.3 MEDIUM |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to view confidential issue references on public projects due to improper authorization checks. | |||||
| CVE-2026-3176 | 1 Gitlab | 1 Gitlab | 2026-06-26 | N/A | 3.1 LOW |
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with limited permissions to access project information due to insufficient authorization checks. | |||||