Total
11419 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-40774 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions. | |||||
| CVE-2026-25425 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions. | |||||
| CVE-2026-0145 | 1 Google | 1 Android | 2026-10-25 | N/A | 4.0 MEDIUM |
| In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-0133 | 1 Google | 1 Android | 2026-10-25 | N/A | 7.8 HIGH |
| In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-54828 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. | |||||
| CVE-2026-56696 | 2026-10-25 | N/A | 5.4 MEDIUM | ||
| OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior. | |||||
| CVE-2026-56384 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset, because no asset-view permission check is performed before preview generation. This affects versions >= 4.0.0-RC1, <= 4.17.7 and >= 5.0.0-RC1, <= 5.9.13, and is fixed in 4.17.8 and 5.9.14. | |||||
| CVE-2026-49291 | 2026-10-25 | N/A | 8.1 HIGH | ||
| mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope. Version 10.65.3 patches the issue. | |||||
| CVE-2026-39503 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions. | |||||
| CVE-2026-54322 | 2026-10-25 | N/A | 7.7 HIGH | ||
| Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the target role by its identifier alone, without verifying the role belonged to that organization. An authenticated user who owns any organization (organizations are self-service) could therefore modify the permissions of, or delete, a role belonging to a different organization, given that role's identifier. This vulnerability is fixed in 0.185.0. | |||||
| CVE-2026-48500 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs. This vulnerability is fixed in 3.3.52, 4.11.5, and 5.6.5. | |||||
| CVE-2026-40742 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio AB Testing: from n/a through <= 8.2.8. | |||||
| CVE-2026-5230 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250. | |||||
| CVE-2026-0158 | 1 Google | 1 Android | 2026-10-25 | N/A | 4.0 MEDIUM |
| In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-48883 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions. | |||||
| CVE-2026-40775 | 2026-10-25 | N/A | 7.3 HIGH | ||
| Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions. | |||||
| CVE-2026-42640 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions. | |||||
| CVE-2026-49775 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions. | |||||
| CVE-2026-48887 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions. | |||||
| CVE-2026-39525 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions. | |||||