Total
11420 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-39525 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions. | |||||
| CVE-2026-47120 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check). This issue has been patched in version 2.0.8. | |||||
| CVE-2026-34898 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions. | |||||
| CVE-2026-57429 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. | |||||
| CVE-2026-8934 | 2026-10-25 | N/A | N/A | ||
| A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched on 7 April 2026, and no customer action is needed. | |||||
| CVE-2026-34024 | 2026-10-25 | N/A | N/A | ||
| The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible in the frontend but remain directly reachable. This allows the attacker to perform restricted actions such as switching the user's branch, uploading arbitrary files, downloading arbitrary files, and viewing details of arbitrary branches. | |||||
| CVE-2026-56280 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection. | |||||
| CVE-2026-40795 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Amelia <= 2.2 versions. | |||||
| CVE-2026-49288 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0. | |||||
| CVE-2026-50084 | 1 Aqara | 1 Cloud Production Api | 2026-10-25 | N/A | 9.6 CRITICAL |
| The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices. | |||||
| CVE-2026-40743 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions. | |||||
| CVE-2026-22343 | 2026-10-25 | N/A | 8.6 HIGH | ||
| Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. | |||||
| CVE-2026-48881 | 2026-10-25 | N/A | 9.1 CRITICAL | ||
| Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. | |||||
| CVE-2026-34886 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions. | |||||
| CVE-2026-42651 | 2026-10-25 | N/A | 6.3 MEDIUM | ||
| Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions. | |||||
| CVE-2026-44914 | 1 Apache | 1 Nifi | 2026-10-25 | N/A | 7.2 HIGH |
| Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization permits a user with general write access to add components with Restricted status. Apache NiFi installations that do not implement specific authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation, which removes the implementation of Restricted status authorization from the framework. | |||||
| CVE-2026-53851 | 1 Openclaw | 1 Openclaw | 2026-10-25 | N/A | 5.3 MEDIUM |
| OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input. | |||||
| CVE-2026-42659 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions. | |||||
| CVE-2026-39533 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions. | |||||
| CVE-2026-41192 | 2026-10-25 | N/A | 7.1 HIGH | ||
| FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in `attachments_all[]` but omitted from retained lists are decrypted and passed directly to `Attachment::deleteByIds()`. Because `load_attachments` returns encrypted IDs for attachments on a visible conversation, a mailbox peer can replay those IDs through `save_draft` and delete the original attachment row and file. Version 1.8.215 fixes the vulnerability. | |||||