Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-77128 | 2026-08-26 | N/A | N/A | ||
| The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled. | |||||
| CVE-2026-72810 | 2026-08-26 | N/A | 8.6 HIGH | ||
| SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication. | |||||
| CVE-2026-73048 | 2026-08-26 | N/A | 5.8 MEDIUM | ||
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotation identifiers visible in published pages, revealing citation relationships across forbidden and password-protected tiers. | |||||
| CVE-2026-72812 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks. | |||||
| CVE-2026-58434 | 2026-08-26 | N/A | 7.5 HIGH | ||
| Private Repository Metadata Remains Accessible After Access Revocation | |||||
| CVE-2026-57886 | 2026-08-26 | N/A | 5.9 MEDIUM | ||
| Cross-repository issue/comment attachment re-linking can expose private attachment content | |||||
| CVE-2026-58432 | 2026-08-26 | N/A | 5.9 MEDIUM | ||
| Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | |||||
| CVE-2026-58433 | 2026-08-26 | N/A | 9.1 CRITICAL | ||
| Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting | |||||
| CVE-2026-58438 | 2026-08-26 | N/A | 7.5 HIGH | ||
| Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access | |||||
| CVE-2026-50105 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | |||||
| CVE-2026-72900 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database. | |||||
| CVE-2026-16471 | 2026-08-26 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8. | |||||
| CVE-2026-16467 | 2026-08-26 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9. | |||||
| CVE-2026-73405 | 2026-08-26 | N/A | N/A | ||
| An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/<topic> endpoint. The token_required decorator used by the Pub/Sub interface authenticated requests solely by matching the X-API-KEY header against an existing user API key. Unlike the REST API authentication mechanism, it did not verify the account's is_active and is_confirmed state. Because the self-registration process issues an API key before account confirmation is completed, an attacker could create an account and immediately use the resulting API key to access Pub/Sub topics that should only be available to active, confirmed users. This could expose stream events that would otherwise be inaccessible through the REST API, including newly submitted or not-yet-moderated data such as comments. The vulnerability results from inconsistent authorization enforcement between the REST API and the SSE streaming interface. The patch corrects the issue by requiring accounts to be both active and confirmed before permitting access to Pub/Sub streams, bringing the SSE authorization boundary in line with the REST API. | |||||
| CVE-2026-15930 | 2026-08-26 | N/A | 9.4 CRITICAL | ||
| The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow. | |||||
| CVE-2026-16285 | 2026-08-26 | N/A | 7.5 HIGH | ||
| The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID. | |||||
| CVE-2026-14317 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled. | |||||
| CVE-2026-16057 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own. | |||||
| CVE-2026-16042 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds. | |||||
| CVE-2026-13389 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state. | |||||