Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-42638 | 2026-10-07 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1. | |||||
| CVE-2026-30959 | 1 Hackerbay | 1 Oneuptime | 2026-10-07 | N/A | 5.0 MEDIUM |
| OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service. | |||||
| CVE-2025-14755 | 2026-10-07 | N/A | 5.3 MEDIUM | ||
| The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccb_woocommerce_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the renderWooCommercePayment() function passing user-controlled data directly to CCBWooCheckout::init() without authorization checks. This makes it possible for unauthenticated attackers to add WooCommerce products to their cart with attacker-controlled prices. | |||||
| CVE-2025-4202 | 2026-10-07 | N/A | 4.3 MEDIUM | ||
| The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf_add_comment' function in all versions up to, and including, 5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to arbitrary collaborations. | |||||
| CVE-2026-30956 | 1 Hackerbay | 1 Oneuptime | 2026-10-07 | N/A | 9.9 CRITICAL |
| OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21. | |||||
| CVE-2026-32442 | 2026-10-07 | N/A | 5.0 MEDIUM | ||
| Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15. | |||||
| CVE-2025-64215 | 2026-10-07 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects MasterStudy LMS Pro: from n/a before 4.7.16. | |||||
| CVE-2025-48640 | 1 Google | 1 Android | 2026-10-07 | N/A | 8.0 HIGH |
| In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2025-48617 | 1 Google | 1 Android | 2026-10-07 | N/A | 7.8 HIGH |
| In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2025-14272 | 2026-10-07 | N/A | N/A | ||
| A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to execute privileged operations, including user/role management and other administrative actions. | |||||
| CVE-2025-69332 | 2026-10-07 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Bookify <= 1.1.1 versions. | |||||
| CVE-2026-102375 | 2026-10-07 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14. | |||||
| CVE-2026-56952 | 2026-10-07 | N/A | 6.7 MEDIUM | ||
| In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2024-32832 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93. | |||||
| CVE-2025-69189 | 2026-10-06 | N/A | 7.3 HIGH | ||
| Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3. | |||||
| CVE-2025-69134 | 2026-10-06 | N/A | 7.5 HIGH | ||
| Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions. | |||||
| CVE-2025-69103 | 2026-10-06 | N/A | 7.5 HIGH | ||
| Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions. | |||||
| CVE-2025-66076 | 2026-10-06 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions. | |||||
| CVE-2026-45632 | 2026-10-06 | N/A | 9.9 CRITICAL | ||
| Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server write and execute scripts on the host or remote servers, enabling RCE on the Dokploy host or a target server. | |||||
| CVE-2025-69137 | 2026-10-06 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Genemy <= 1.6.6 versions. | |||||