Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-14873 | 2026-09-10 | N/A | 8.0 HIGH | ||
| The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. | |||||
| CVE-2026-86993 | 1 N8n | 1 N8n | 2026-09-10 | N/A | 4.9 MEDIUM |
| n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint. The affected authorization boundary is packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts and the credential:read scope. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. | |||||
| CVE-2026-86994 | 1 N8n | 1 N8n | 2026-09-10 | N/A | 4.3 MEDIUM |
| n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. | |||||
| CVE-2026-86996 | 1 N8n | 1 N8n | 2026-09-10 | N/A | 5.4 MEDIUM |
| n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data. The affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject. This issue is fixed in versions 2.37.7 and 2.38.2. | |||||
| CVE-2026-87475 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 6.5 MEDIUM |
| Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87513 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 6.5 MEDIUM |
| Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-41869 | 1 Apache | 1 Nutch | 2026-09-10 | N/A | 9.1 CRITICAL |
| Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ . | |||||
| CVE-2026-41871 | 1 Apache | 1 Nutch | 2026-09-10 | N/A | 9.8 CRITICAL |
| Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ . | |||||
| CVE-2026-87543 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 4.3 MEDIUM |
| Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-87431 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 7.5 HIGH |
| Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) | |||||
| CVE-2026-87429 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 6.5 MEDIUM |
| Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-85226 | 1 Misp-project | 1 Misp | 2026-09-10 | N/A | 4.3 MEDIUM |
| MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events. As a result, an authenticated user could receive correlation results referring to attributes or events that the user was not authorized to access. The vulnerable correlation collection path did not take the requesting user into account. The patch changes the correlation collector to accept the current user and filters the resulting attribute identifiers through MISP's existing fetchAttributesSimple() authorization logic, which evaluates event-, attribute-, object-, distribution-, and sharing-group-level restrictions against the live data. The issue also affected paths relying on previously stored correlation data. Because the OnDemand engine does not maintain the stored correlation table, its denormalized access-control information could be stale. The patch therefore validates correlated attribute identifiers against the current ACLs before returning them and additionally applies normal event visibility conditions when retrieving related events. An authenticated low-privileged user could exploit this issue by querying or creating attributes that correlate with restricted MISP content, potentially learning information about otherwise inaccessible events or attributes. | |||||
| CVE-2026-87441 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 6.5 MEDIUM |
| Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) | |||||
| CVE-2026-87560 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 4.3 MEDIUM |
| Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87556 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 4.3 MEDIUM |
| Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87534 | 1 Google | 2 Android, Chrome | 2026-09-10 | N/A | 9.8 CRITICAL |
| Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-86840 | 2026-09-10 | N/A | 9.1 CRITICAL | ||
| The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement. | |||||
| CVE-2026-87537 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 8.1 HIGH |
| Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-88915 | 2026-09-10 | N/A | N/A | ||
| Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharing_group_id. The instantiation path passed that value into event creation without verifying that the user instantiating the template was actually permitted to use the selected sharing group. The commit notes that Event::_add() only performed its own sharing-group authorization in another code path, leaving template instantiation able to write the identifier directly. The same instantiation path also attached template-specified tags without checking the user's normal tagging permissions. In addition, it hardcoded local => 0, meaning tags marked local_only could be attached globally and consequently propagate through synchronization or export, contrary to their intended restriction. The fix adds explicit SharingGroup::canUse() authorization for the acting user, applies the same tag-modification checks used by normal event tagging, and ensures local_only tags are attached locally. Version affected: ≤2.5.45 | |||||
| CVE-2026-88271 | 2026-09-10 | N/A | 8.8 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. | |||||