Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-81761 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in WpEvently <= 5.5.0 versions. | |||||
| CVE-2026-81759 | 2026-08-28 | N/A | 5.4 MEDIUM | ||
| Contributor Broken Access Control in WpEvently <= 5.5.0 versions. | |||||
| CVE-2026-81284 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions. | |||||
| CVE-2026-81276 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions. | |||||
| CVE-2026-80433 | 2026-08-28 | N/A | 7.5 HIGH | ||
| Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions. | |||||
| CVE-2026-54418 | 2026-08-28 | N/A | 8.1 HIGH | ||
| Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher). | |||||
| CVE-2026-78137 | 2026-08-28 | N/A | 7.5 HIGH | ||
| The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled. | |||||
| CVE-2026-13414 | 2026-08-28 | N/A | 4.8 MEDIUM | ||
| The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration. | |||||
| CVE-2026-12514 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded. | |||||
| CVE-2026-77701 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site. | |||||
| CVE-2026-79085 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-79086 | 1 Google | 2 Android, Chrome | 2026-08-28 | N/A | 5.1 MEDIUM |
| Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium) | |||||
| CVE-2026-65931 | 2026-08-28 | N/A | N/A | ||
| LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records. This issue affects LimeSurvey: 7.0.5. | |||||
| CVE-2026-66109 | 2026-08-28 | N/A | 7.8 HIGH | ||
| A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege. | |||||
| CVE-2026-19017 | 2026-08-28 | N/A | 6.8 MEDIUM | ||
| Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. | |||||
| CVE-2026-15916 | 2026-08-28 | N/A | 4.2 MEDIUM | ||
| Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*. | |||||
| CVE-2026-16645 | 2026-08-28 | N/A | 9.1 CRITICAL | ||
| Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0. | |||||
| CVE-2026-81819 | 2026-08-28 | N/A | N/A | ||
| Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier. The fix changes: method_decorators = [api_required] to: method_decorators = [admin_or_org_admin_required, api_required] so only administrators or organization administrators can perform cross-user assignment queries. Version impacted =>3.3.0 | |||||
| CVE-2026-27330 | 2026-08-28 | N/A | 8.6 HIGH | ||
| Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions. | |||||
| CVE-2026-81274 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| Subscriber Broken Access Control in Ditty <= 3.1.67 versions. | |||||