Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-93832 | 2026-10-02 | N/A | 4.4 MEDIUM | ||
| A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps. | |||||
| CVE-2026-94541 | 2026-10-02 | N/A | 9.8 CRITICAL | ||
| The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker. | |||||
| CVE-2026-85209 | 2026-10-02 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System (LMS): through 2026-09-18. | |||||
| CVE-2026-104410 | 2026-10-02 | N/A | 7.5 HIGH | ||
| SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values. | |||||
| CVE-2026-90952 | 2026-10-02 | N/A | 5.3 MEDIUM | ||
| The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide. | |||||
| CVE-2026-91023 | 2026-10-02 | N/A | 3.1 LOW | ||
| The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration. | |||||
| CVE-2026-97219 | 2026-10-02 | N/A | 4.3 MEDIUM | ||
| The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying. | |||||
| CVE-2026-85005 | 2026-10-02 | N/A | 5.4 MEDIUM | ||
| The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service. | |||||
| CVE-2026-79618 | 2026-10-02 | N/A | 4.3 MEDIUM | ||
| The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers. | |||||
| CVE-2026-39439 | 2026-10-02 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7. | |||||
| CVE-2026-101879 | 2026-10-02 | N/A | 6.5 MEDIUM | ||
| OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction. | |||||
| CVE-2026-100266 | 1 Jetbrains | 1 Hub | 2026-10-02 | N/A | 7.7 HIGH |
| In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address | |||||
| CVE-2026-100271 | 1 Jetbrains | 1 Youtrack | 2026-10-02 | N/A | 2.7 LOW |
| In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects | |||||
| CVE-2026-104467 | 2026-10-02 | N/A | 8.1 HIGH | ||
| YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives. | |||||
| CVE-2026-104438 | 2026-10-02 | N/A | 5.3 MEDIUM | ||
| YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages. | |||||
| CVE-2026-100280 | 1 Jetbrains | 1 Youtrack | 2026-10-02 | N/A | 3.1 LOW |
| In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible | |||||
| CVE-2026-80337 | 2026-10-02 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported. | |||||
| CVE-2026-104472 | 2026-10-02 | N/A | 7.5 HIGH | ||
| YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages. | |||||
| CVE-2024-32949 | 2026-10-02 | N/A | 8.3 HIGH | ||
| Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Integrate Google Drive: from n/a through 1.3.8. | |||||
| CVE-2024-37496 | 2026-10-02 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.3.7. | |||||