Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-101047 | 1 Fleetdm | 1 Fleet | 2026-10-07 | N/A | 5.3 MEDIUM |
| Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense). | |||||
| CVE-2026-62179 | 2026-10-07 | N/A | 6.5 MEDIUM | ||
| PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue. | |||||
| CVE-2026-39730 | 2026-10-07 | N/A | 7.1 HIGH | ||
| Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3. | |||||
| CVE-2026-105488 | 2026-10-07 | N/A | 7.1 HIGH | ||
| Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries. | |||||
| CVE-2026-14259 | 1 Mattermost | 1 Mattermost Server | 2026-10-07 | N/A | 4.3 MEDIUM |
| Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00712 | |||||
| CVE-2026-14344 | 1 Mattermost | 1 Mattermost Server | 2026-10-07 | N/A | 4.3 MEDIUM |
| Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory ID: MMSA-2026-00715 | |||||
| CVE-2026-18132 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 6.5 MEDIUM |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization. | |||||
| CVE-2026-8821 | 1 Mattermost | 1 Mattermost Server | 2026-10-07 | N/A | 7.1 HIGH |
| Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field.. Mattermost Advisory ID: MMSA-2026-00677 | |||||
| CVE-2026-81164 | 1 Entity Pdf Project | 1 Entity Pdf | 2026-10-07 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5. | |||||
| CVE-2026-103323 | 2026-10-07 | N/A | 5.9 MEDIUM | ||
| The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers. | |||||
| CVE-2026-82211 | 2026-10-07 | N/A | 8.2 HIGH | ||
| The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details. | |||||
| CVE-2026-93026 | 2026-10-07 | N/A | N/A | ||
| This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials. | |||||
| CVE-2026-58068 | 2026-10-07 | N/A | N/A | ||
| This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system. | |||||
| CVE-2026-106264 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 5.4 MEDIUM |
| Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-106312 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 6.5 MEDIUM |
| Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) | |||||
| CVE-2026-106323 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-07 | N/A | 9.6 CRITICAL |
| Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-106388 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 5.3 MEDIUM |
| Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-106406 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-07 | N/A | 5.4 MEDIUM |
| Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-106410 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 4.2 MEDIUM |
| Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-27434 | 2026-10-07 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2. | |||||