Total
11419 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-59992 | 2026-10-26 | N/A | 5.4 MEDIUM | ||
| Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without enforcing the operator's configured mediaRoot. In packages/next-tinacms-s3/src/handlers.ts, createMediaHandler accepts req.query.key for a signed PutObject URL and the DELETE path uses req.query.media as the DeleteObjectCommand key. The same missing key-boundary check exists in packages/next-tinacms-dos/src/handlers.ts, packages/next-tinacms-azure/src/handlers.ts, and packages/next-tinacms-cloudinary/src/handlers.ts. An authenticated CMS editor can therefore create or delete objects anywhere the deployment's storage credential can reach, including other tenants' or non-media objects. These issues are fixed in next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4. | |||||
| CVE-2026-19755 | 2026-10-26 | N/A | N/A | ||
| NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1. | |||||
| CVE-2026-61663 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9. | |||||
| CVE-2026-63003 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9. | |||||
| CVE-2026-54624 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8. | |||||
| CVE-2026-53569 | 2026-10-26 | N/A | N/A | ||
| Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata. No released fixed version is available as of this review. | |||||
| CVE-2026-16962 | 2026-10-26 | N/A | 5.3 MEDIUM | ||
| The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects). | |||||
| CVE-2026-76257 | 1 Splunk | 2 Splunk, Splunk Secure Gateway | 2026-10-26 | N/A | 6.5 MEDIUM |
| In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests. | |||||
| CVE-2026-42377 | 2026-10-26 | N/A | 7.3 HIGH | ||
| Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms Pro: from n/a through 2.8.0. | |||||
| CVE-2026-42642 | 2026-10-26 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5. | |||||
| CVE-2026-40728 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Blocks: from n/a through <= 1.8.3. | |||||
| CVE-2026-49081 | 2026-10-26 | N/A | 8.2 HIGH | ||
| Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. | |||||
| CVE-2026-5022 | 1 Langflow | 1 Langflow | 2026-10-26 | N/A | 5.3 MEDIUM |
| The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name. | |||||
| CVE-2026-28615 | 1 Google | 1 Android | 2026-10-26 | N/A | 7.8 HIGH |
| In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-8407 | 1 Devolutions | 1 Devolutions Server | 2026-10-26 | N/A | 4.3 MEDIUM |
| Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier | |||||
| CVE-2026-42753 | 2026-10-26 | N/A | 7.3 HIGH | ||
| Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through <= 2.11.10. | |||||
| CVE-2026-27672 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information. This vulnerability has a low impact on confidentiality and does not affect integrity and availability of the system. | |||||
| CVE-2026-40776 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions. | |||||
| CVE-2026-27366 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. | |||||
| CVE-2026-48969 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions. | |||||