Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-81841 | 2026-09-30 | N/A | 5.3 MEDIUM | ||
| Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token. | |||||
| CVE-2026-103239 | 2026-09-30 | N/A | N/A | ||
| MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload. A user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator. Preconditions: - An authenticated account with the tag editor permission (perm_tag_editor) - Network access to the MISP instance Impact: - Unauthorized creation or modification of User and Organisation records - Privilege escalation from tag editor to site administrator Affected versions: < 2.5.48 | |||||
| CVE-2026-95287 | 1 Google | 1 Chrome | 2026-09-30 | N/A | 5.4 MEDIUM |
| Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-95320 | 1 Google | 1 Chrome | 2026-09-30 | N/A | 5.4 MEDIUM |
| Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-85576 | 2026-09-30 | N/A | 4.3 MEDIUM | ||
| The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them. | |||||
| CVE-2026-94297 | 2026-09-30 | N/A | 2.7 LOW | ||
| The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site. | |||||
| CVE-2026-93580 | 2026-09-30 | N/A | 5.3 MEDIUM | ||
| The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed. | |||||
| CVE-2026-100744 | 2026-09-30 | 7.5 HIGH | 7.3 HIGH | ||
| A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.2.0 is sufficient to fix this issue. This patch is called 39ae16de4248075de8c08f3259114e064b20d52d. It is advisable to upgrade the affected component. | |||||
| CVE-2025-12898 | 2026-09-30 | N/A | 5.3 MEDIUM | ||
| The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings. | |||||
| CVE-2026-65489 | 2026-09-30 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2. | |||||
| CVE-2026-97285 | 2026-09-30 | N/A | 5.4 MEDIUM | ||
| Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. | |||||
| CVE-2026-97267 | 2026-09-30 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions. | |||||
| CVE-2026-97247 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. | |||||
| CVE-2026-97243 | 2026-09-30 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. | |||||
| CVE-2026-97239 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. | |||||
| CVE-2026-97197 | 2026-09-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions. | |||||
| CVE-2026-96834 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. | |||||
| CVE-2026-96823 | 2026-09-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions. | |||||
| CVE-2026-96818 | 2026-09-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions. | |||||
| CVE-2026-96817 | 2026-09-30 | N/A | 8.2 HIGH | ||
| Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions. | |||||