Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-68086 | 2026-10-05 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reformer for Elementor: from n/a through <= 1.0.6. | |||||
| CVE-2025-63079 | 2026-10-05 | N/A | 4.3 MEDIUM | ||
| Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions. | |||||
| CVE-2026-103490 | 1 Jetbrains | 1 Youtrack | 2026-10-05 | N/A | 7.2 HIGH |
| In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | |||||
| CVE-2025-53345 | 2026-10-05 | N/A | 8.8 HIGH | ||
| Missing Authorization vulnerability in ThimPress Thim Core thim-core.This issue affects Thim Core: from n/a through 2.3.3. | |||||
| CVE-2026-81793 | 2026-10-05 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9. | |||||
| CVE-2025-32220 | 1 Salonbookingsystem | 1 Salon Booking System | 2026-10-05 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9. | |||||
| CVE-2026-97258 | 2026-10-03 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions. | |||||
| CVE-2026-96613 | 2026-10-03 | N/A | 6.5 MEDIUM | ||
| The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device. | |||||
| CVE-2026-92245 | 2026-10-03 | N/A | 7.5 HIGH | ||
| The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization. | |||||
| CVE-2026-88999 | 2026-10-03 | N/A | 4.3 MEDIUM | ||
| The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page. | |||||
| CVE-2026-62073 | 2026-10-03 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions. | |||||
| CVE-2026-32585 | 2026-10-03 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Airano MCP Bridge: from n/a through 2.11.0. | |||||
| CVE-2026-104912 | 2026-10-03 | N/A | N/A | ||
| MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation row rather than the live event access control list. Because the correlation row's distribution columns are a point-in-time copy that lacks a published flag, the authorization check becomes incorrect when an event is subsequently restricted (for example, its sharing group is changed or it is unpublished). As a result, an authenticated user could retrieve attributes and event details belonging to events they no longer have permission to view. Preconditions: - An authenticated user with at least read access to some events in the instance. - The existence of correlations between events, at least one of which has been restricted after the correlation was created. Impact: - Confidentiality: exposure of attribute values and event metadata that the user is not authorized to access. Affected versions: MISP prior to v2.5.48. | |||||
| CVE-2026-104910 | 2026-10-03 | N/A | N/A | ||
| MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each related event. The correlation table stores a snapshot of the event's distribution level and sharing group at the time the correlation was created, and does not carry the published flag. As a result, events that the caller is not permitted to open—because they are unpublished, or because their distribution or sharing group has changed since the correlation was recorded—were still returned with their metadata (title, date, correlating value counts). Preconditions: - An authenticated user with access to at least one event in MISP. - The existence of correlation entries linking that event to other events the user should not be able to view. Impact: - Unauthorized disclosure of event metadata (titles, dates, correlation counts) for events the user has no right to access. - Potential reconnaissance of threat-intelligence event names and timelines across sharing groups. Affected: MISP versions prior to the fix commit (2ffa97f05). | |||||
| CVE-2026-101104 | 2026-10-03 | N/A | 7.7 HIGH | ||
| The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions. | |||||
| CVE-2026-90448 | 2026-10-02 | N/A | 6.5 MEDIUM | ||
| A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode. | |||||
| CVE-2026-90454 | 2026-10-02 | N/A | 4.3 MEDIUM | ||
| A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records. | |||||
| CVE-2026-104054 | 2026-10-02 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance. | |||||
| CVE-2026-95285 | 1 Google | 2 Android, Chrome | 2026-10-02 | N/A | 8.4 HIGH |
| Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-95278 | 1 Google | 1 Chrome | 2026-10-02 | N/A | 8.4 HIGH |
| Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | |||||