Total
11406 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-0092 | 1 Google | 1 Android | 2026-10-26 | N/A | N/A |
| In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-48973 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Benbodhi SVG Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SVG Support: from n/a through 2.5.14. | |||||
| CVE-2026-11858 | 2026-10-26 | N/A | N/A | ||
| Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated low-privileged user can connect to the interface and invoke privileged update methods such as Update(). This allows arbitrary file write and delete operations with SYSTEM privileges and can be used to achieve local privilege escalation. | |||||
| CVE-2026-49045 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Adminimize: from n/a through 1.11.11. | |||||
| CVE-2026-54810 | 2026-10-26 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexi XPay: from n/a through 8.3.1. | |||||
| CVE-2026-46414 | 2026-10-26 | N/A | 8.8 HIGH | ||
| Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied identity and role fields in task messages. A client connection can register as a normal device, but later send a TASK message claiming client_type="constellation" and target_id=<victim-device-id>. The server trusts the role and target values from the wire message rather than enforcing the role registered for that WebSocket connection. As a result, any authenticated WebSocket client with the shared server token can spoof the higher-privilege constellation role and dispatch attacker-controlled tasks to another connected device. The same client registry also allows duplicate client_id registration, overwriting an existing live client's stored websocket, role, and task protocol. This is an authenticated WebSocket role/identity spoofing issue leading to peer task hijacking. | |||||
| CVE-2026-0057 | 1 Google | 1 Android | 2026-10-26 | N/A | 3.3 LOW |
| In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-0071 | 1 Google | 1 Android | 2026-10-26 | N/A | 7.8 HIGH |
| In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-0081 | 1 Google | 1 Android | 2026-10-26 | N/A | 7.8 HIGH |
| In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-48971 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6. | |||||
| CVE-2026-40722 | 2026-10-26 | N/A | 5.5 MEDIUM | ||
| Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6. | |||||
| CVE-2026-52711 | 2026-10-26 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions. | |||||
| CVE-2026-11852 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The endpoints that create and delete relationships between artifacts enforced no permissions checks beyond being able to see the artifacts in question. | |||||
| CVE-2026-48783 | 2026-10-26 | N/A | 4.8 MEDIUM | ||
| Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The endpoint, /public/modify-subscription, could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint. This issue has been fixed in version 2.21.8. | |||||
| CVE-2026-39595 | 2026-10-26 | N/A | 4.7 MEDIUM | ||
| Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. | |||||
| CVE-2026-28587 | 1 Google | 1 Android | 2026-10-26 | N/A | 5.5 MEDIUM |
| In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-56402 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response payloads without proper role validation. | |||||
| CVE-2026-49057 | 2026-10-26 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. | |||||
| CVE-2026-28573 | 2 Google, Samsung | 2 Android, Wear Os | 2026-10-26 | N/A | 5.5 MEDIUM |
| In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-40809 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1. | |||||