Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-14633 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'file_download' function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to download any file from the WordPress media library by guessing or enumerating WordPress attachment IDs. | |||||
| CVE-2026-100269 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed | |||||
| CVE-2026-103274 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings. | |||||
| CVE-2026-103269 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content). | |||||
| CVE-2026-101000 | 2026-10-01 | 10.0 HIGH | 10.0 CRITICAL | ||
| A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-95290 | 1 Google | 1 Chrome | 2026-10-01 | N/A | 5.4 MEDIUM |
| Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-95297 | 1 Google | 1 Chrome | 2026-10-01 | N/A | 6.5 MEDIUM |
| Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-95300 | 1 Google | 1 Chrome | 2026-10-01 | N/A | 4.8 MEDIUM |
| Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-95301 | 1 Google | 1 Chrome | 2026-10-01 | N/A | 8.1 HIGH |
| Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-103268 | 2026-10-01 | N/A | 8.8 HIGH | ||
| Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and restore their original privileges. | |||||
| CVE-2026-95342 | 1 Google | 1 Chrome | 2026-10-01 | N/A | 4.3 MEDIUM |
| Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-102381 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0. | |||||
| CVE-2026-103341 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20. | |||||
| CVE-2026-62063 | 2026-10-01 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1. | |||||
| CVE-2026-102390 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9. | |||||
| CVE-2026-103495 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs | |||||
| CVE-2026-103260 | 2026-10-01 | N/A | 4.0 MEDIUM | ||
| n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions. | |||||
| CVE-2026-96200 | 2026-10-01 | N/A | 5.3 MEDIUM | ||
| The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment. | |||||
| CVE-2026-90974 | 2026-10-01 | N/A | 6.5 MEDIUM | ||
| The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host. | |||||
| CVE-2026-47559 | 2026-10-01 | N/A | 7.8 HIGH | ||
| NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonging to another user's process. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. | |||||