Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-13611 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key. | |||||
| CVE-2026-81762 | 2026-09-01 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions. | |||||
| CVE-2026-81278 | 2026-09-01 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1. | |||||
| CVE-2026-81296 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | |||||
| CVE-2026-81758 | 2026-09-01 | N/A | 6.3 MEDIUM | ||
| Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. | |||||
| CVE-2026-19948 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler. | |||||
| CVE-2026-77966 | 2026-09-01 | N/A | 8.8 HIGH | ||
| The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the device. | |||||
| CVE-2026-76209 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-09-01 | N/A | 4.3 MEDIUM |
| phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page. | |||||
| CVE-2026-76211 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-09-01 | N/A | 4.3 MEDIUM |
| phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session. | |||||
| CVE-2026-76215 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-09-01 | N/A | 5.3 MEDIUM |
| phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints. | |||||
| CVE-2026-24369 | 2026-09-01 | N/A | 7.1 HIGH | ||
| Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0. | |||||
| CVE-2026-24368 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0. | |||||
| CVE-2026-19616 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2. | |||||
| CVE-2026-82544 | 2026-08-31 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue. | |||||
| CVE-2026-80193 | 2026-08-31 | N/A | 8.8 HIGH | ||
| Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere. | |||||
| CVE-2026-79666 | 2026-08-31 | N/A | 6.5 MEDIUM | ||
| Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs. | |||||
| CVE-2026-79665 | 2026-08-31 | N/A | 8.8 HIGH | ||
| Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints. | |||||
| CVE-2026-79672 | 2026-08-31 | N/A | 5.5 MEDIUM | ||
| Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment system settings by directly accessing the unprotected panel endpoints. | |||||
| CVE-2026-72824 | 2026-08-31 | N/A | 8.8 HIGH | ||
| The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page save even though admin.pages_twig is intentionally outside the api.pages scope. When security.twig_content.process_enabled=true and editor_enabled=false, this allows Twig-in-content to execute server-side, resulting in server-side template injection (SSTI) and remote code execution. | |||||
| CVE-2026-72823 | 2026-08-31 | N/A | 5.4 MEDIUM | ||
| The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a super account can bypass its scope restrictions when calling the baseline() and reset() operations (e.g. POST /api/v1/demo/reset), allowing it to capture the demo baseline or force a demo reset. Impact is bounded to demo-engine control and is conditional on demo mode being configured with writable resources. | |||||