Total
11406 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-45436 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions. | |||||
| CVE-2026-53438 | 1 Jenkins | 1 Jenkins | 2026-10-26 | N/A | 4.3 MEDIUM |
| A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view. | |||||
| CVE-2026-49054 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Post Grid: from n/a through 7.9.2. | |||||
| CVE-2026-42851 | 1 Kovidgoyal | 1 Kitty | 2026-10-26 | N/A | 7.8 HIGH |
| Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue. | |||||
| CVE-2026-40723 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. | |||||
| CVE-2026-49047 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in DearHive DearFlip allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DearFlip: from n/a through 2.4.27. | |||||
| CVE-2026-42726 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AWP Classifieds: from n/a through <= 4.4.5. | |||||
| CVE-2026-47163 | 2026-10-26 | N/A | N/A | ||
| Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord default permission requirement and no runtime moderator permission check. An attacker can add a rule matching common text and make the bot delete other users’ messages. This issue has been patched in version 1.0.1. | |||||
| CVE-2026-52866 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection. | |||||
| CVE-2026-49205 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The following APIs are affected: POST /api/v4.0/category (CategoryController::create), POST /api/v4.0/faq (FaqController::create), PUT /api/v4.0/faq (FaqController::update), and POST /api/v4.0/question (QuestionController::create). This issue has been fixed in version 4.1.4. | |||||
| CVE-2026-24611 | 2026-10-26 | N/A | 9.1 CRITICAL | ||
| Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. | |||||
| CVE-2026-11719 | 1 Google | 1 Mcp Toolbox For Databases | 2026-10-26 | N/A | 8.1 HIGH |
| An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRequired, older supported protocol versions (2025-06-18, 2025-03-26, and 2024-11-05) omit this check. An authenticated client with low-privilege tokens (e.g., read) can bypass the intended per-tool scope restrictions and execute high-privilege tools (e.g., admin) simply by specifying an older protocol version in the MCP-Protocol-Version header, or by omitting the header entirely (which causes the server to default to the vulnerable 2024-11-05 handler). | |||||
| CVE-2026-24610 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. | |||||
| CVE-2026-39490 | 2026-10-26 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. | |||||
| CVE-2026-49072 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. | |||||
| CVE-2026-46558 | 1 Plane | 1 Plane | 2026-10-26 | N/A | 8.3 HIGH |
| Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1. | |||||
| CVE-2026-40726 | 2026-10-26 | N/A | 8.2 HIGH | ||
| Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. | |||||
| CVE-2026-4764 | 2026-10-26 | N/A | N/A | ||
| A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform allows an authenticated user with specific roles to escalate privileges and potentially take over a GCP project using a maliciously crafted playbook import. This vulnerability was patched on 15 March 2026, and no customer action is needed. | |||||
| CVE-2026-56695 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and file paths via shared gateway channels. | |||||
| CVE-2026-49357 | 2026-10-26 | N/A | N/A | ||
| Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. `line-desktop-mcp` supports a `--http-mode` Streamable HTTP transport for use with clients such as n8n. In this mode the server binds to `0.0.0.0` and exposes the MCP `/mcp` endpoint without an MCP-layer authentication check. Prior to version 1.1.2, any network client that can reach the port can initialize a session, list tools, and call tools that read LINE Desktop chat history or send LINE messages through the already logged-in desktop application. Version 1.1.2 fixes the issue. | |||||