Total
11531 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-108605 | 2026-10-14 | N/A | 4.3 MEDIUM | ||
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users. | |||||
| CVE-2026-108112 | 2026-10-14 | N/A | 5.4 MEDIUM | ||
| ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows. | |||||
| CVE-2022-20572 | 1 Google | 1 Android | 2026-10-14 | N/A | 6.7 MEDIUM |
| In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel | |||||
| CVE-2026-106646 | 2026-10-14 | N/A | 5.9 MEDIUM | ||
| The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators. | |||||
| CVE-2026-94360 | 2026-10-14 | N/A | 5.3 MEDIUM | ||
| The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed. | |||||
| CVE-2026-94260 | 2026-10-14 | N/A | 5.3 MEDIUM | ||
| The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state. | |||||
| CVE-2026-105975 | 2026-10-14 | N/A | 5.3 MEDIUM | ||
| The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts. | |||||
| CVE-2026-108064 | 2026-10-14 | N/A | 6.5 MEDIUM | ||
| The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance. | |||||
| CVE-2026-104751 | 2026-10-14 | N/A | 5.3 MEDIUM | ||
| The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it. | |||||
| CVE-2026-107158 | 2026-10-14 | N/A | 5.3 MEDIUM | ||
| The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings. | |||||
| CVE-2025-69353 | 2026-10-14 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Proxy & VPN Blocker: from n/a through <= 3.5.3. | |||||
| CVE-2026-106176 | 2026-10-14 | N/A | 3.8 LOW | ||
| A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests | |||||
| CVE-2026-85433 | 1 Themoos | 1 Essential-moos | 2026-10-14 | N/A | 9.8 CRITICAL |
| MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations. | |||||
| CVE-2026-107431 | 2026-10-14 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6. | |||||
| CVE-2026-109672 | 2026-10-14 | N/A | 6.5 MEDIUM | ||
| Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits. | |||||
| CVE-2026-109614 | 2026-10-14 | N/A | 6.5 MEDIUM | ||
| Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view. | |||||
| CVE-2026-62040 | 2026-10-14 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1. | |||||
| CVE-2026-109642 | 2026-10-14 | N/A | 4.3 MEDIUM | ||
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits. | |||||
| CVE-2026-109637 | 2026-10-14 | N/A | 6.5 MEDIUM | ||
| Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records. | |||||
| CVE-2026-109632 | 2026-10-14 | N/A | 6.5 MEDIUM | ||
| Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits. | |||||