Total
11420 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-41679 | 1 Paperclip | 2 Paperclipai, Paperclipai\/server | 2026-10-25 | N/A | 10.0 CRITICAL |
| Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue. | |||||
| CVE-2026-54830 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions. | |||||
| CVE-2026-39524 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions. | |||||
| CVE-2026-42664 | 2026-10-25 | N/A | 8.2 HIGH | ||
| Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions. | |||||
| CVE-2026-40773 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions. | |||||
| CVE-2026-40788 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Subscriber Broken Access Control in ChatBot <= 7.9.7 versions. | |||||
| CVE-2026-42666 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions. | |||||
| CVE-2026-56767 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints. | |||||
| CVE-2026-57520 | 1 Bitwarden | 1 Server | 2026-10-25 | N/A | 7.1 HIGH |
| Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization. | |||||
| CVE-2026-57307 | 1 Jenkins | 1 Zowe Zdevops | 2026-10-25 | N/A | 4.2 MEDIUM |
| A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2026-48941 | 1 Joomlaworks | 1 K2 | 2026-10-25 | N/A | 6.5 MEDIUM |
| The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/` | |||||
| CVE-2026-57923 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 5.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings | |||||
| CVE-2026-2299 | 1 Mattermost | 1 Google Drive | 2026-10-25 | N/A | 4.2 MEDIUM |
| The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership. | |||||
| CVE-2026-57304 | 1 Jenkins | 1 Assembla | 2026-10-25 | N/A | 5.4 MEDIUM |
| A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password. | |||||
| CVE-2026-57285 | 1 Jenkins | 1 Github Branch Source | 2026-10-25 | N/A | 4.3 MEDIUM |
| A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration. | |||||
| CVE-2026-57286 | 1 Jenkins | 1 Git Parameter | 2026-10-25 | N/A | 4.3 MEDIUM |
| A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata. | |||||
| CVE-2026-54027 | 1 Librechat | 1 Librechat | 2026-10-25 | N/A | 6.5 MEDIUM |
| LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1. | |||||
| CVE-2026-54029 | 1 Librechat | 1 Librechat | 2026-10-25 | N/A | 5.3 MEDIUM |
| LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMessageReq middleware only validates that the conversationId belongs to the requesting user, but the handler calls deleteMessages({ messageId }) using only the messageId as the MongoDB filter — without adding a user constraint. An attacker provides their own valid conversationId (to pass validation) and the victim's messageId (to target deletion), resulting in permanent, irrecoverable message deletion. This vulnerability is fixed in 0.8.4-rc1. | |||||
| CVE-2026-24547 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions. | |||||
| CVE-2026-56768 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees. | |||||