Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-47226 | 2026-09-09 | N/A | 6.5 MEDIUM | ||
| Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacker bypasses the upload-right check entirely and permanently deletes the file. This is an incomplete fix of GHSA-rmpj-3x5m-9m5f, which was patched in v5.0.7 but remains exploitable in v5.0.9. User should upgrade to v5.0.10 to receive an updated fix. | |||||
| CVE-2026-47233 | 2026-09-09 | N/A | 6.5 MEDIUM | ||
| Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix. | |||||
| CVE-2026-69090 | 2026-09-09 | N/A | 4.9 MEDIUM | ||
| Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization. | |||||
| CVE-2026-87434 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 3.1 LOW |
| Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87622 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 4.3 MEDIUM |
| Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-55658 | 2026-09-09 | N/A | 7.7 HIGH | ||
| Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 percent margin). cancelProposal then zeroes the escrow's GDA member units but never reclaims that parked balance, and the permissionless claim() forwards the escrow's entire balance, including the pool funded buffer, to the beneficiary. The beneficiary is chosen by the proposal submitter and defaults to the submitter. The only path that returns escrow funds to the pool is drainToStrategy, which is onlyStrategy and is reached solely from the dispute reject ruling, never from cancel or natural completion. At time of publication, there are no publicly known patches. | |||||
| CVE-2026-68484 | 2026-09-09 | N/A | N/A | ||
| Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges. | |||||
| CVE-2026-87498 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 3.1 LOW |
| Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-81269 | 1 Data Field Project | 1 Data Field | 2026-09-09 | N/A | 5.3 MEDIUM |
| Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13. | |||||
| CVE-2026-87605 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 5.3 MEDIUM |
| Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-87611 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 3.1 LOW |
| Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87631 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 6.5 MEDIUM |
| Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-69465 | 1 Microsoft | 1 Sharepoint Server | 2026-09-09 | N/A | 8.8 HIGH |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-52766 | 2026-09-09 | N/A | 9.1 CRITICAL | ||
| YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6. | |||||
| CVE-2026-11821 | 2026-09-09 | N/A | 5.4 MEDIUM | ||
| The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators. | |||||
| CVE-2026-69724 | 1 Microsoft | 1 Sharepoint Server | 2026-09-09 | N/A | 8.8 HIGH |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-87443 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 6.5 MEDIUM |
| Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-85133 | 2026-09-09 | N/A | 5.4 MEDIUM | ||
| The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration. | |||||
| CVE-2026-85132 | 2026-09-09 | N/A | 4.3 MEDIUM | ||
| The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured. | |||||
| CVE-2026-82848 | 2026-09-09 | N/A | 5.3 MEDIUM | ||
| The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners' enrolment records as well. | |||||