Total
9874 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-15060 | 2026-09-01 | N/A | 4.7 MEDIUM | ||
| When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected | |||||
| CVE-2026-78365 | 2026-09-01 | N/A | N/A | ||
| Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body. | |||||
| CVE-2026-19539 | 2026-09-01 | N/A | N/A | ||
| Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to another company, to hijack another company's tickets by reassigning their company_id, and to delete another company's tickets without any authorization check, via the ticket's numeric identifier, because the read and save operations retrieve the record without constraining the query to the authenticated user's company, and the delete controller type-hints a generic Illuminate\Http\Request instead of the TicketDeleteRequest that would enforce the required permission. | |||||
| CVE-2026-13611 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key. | |||||
| CVE-2026-81762 | 2026-09-01 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions. | |||||
| CVE-2026-81278 | 2026-09-01 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1. | |||||
| CVE-2026-81296 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | |||||
| CVE-2026-81758 | 2026-09-01 | N/A | 6.3 MEDIUM | ||
| Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. | |||||
| CVE-2026-19948 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler. | |||||
| CVE-2026-77966 | 2026-09-01 | N/A | 8.8 HIGH | ||
| The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the device. | |||||
| CVE-2026-76209 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-09-01 | N/A | 4.3 MEDIUM |
| phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page. | |||||
| CVE-2026-76211 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-09-01 | N/A | 4.3 MEDIUM |
| phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session. | |||||
| CVE-2026-76215 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-09-01 | N/A | 5.3 MEDIUM |
| phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints. | |||||
| CVE-2026-24369 | 2026-09-01 | N/A | 7.1 HIGH | ||
| Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0. | |||||
| CVE-2026-24368 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0. | |||||
| CVE-2026-19616 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2. | |||||
| CVE-2026-82544 | 2026-08-31 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314. It is advisable to implement a patch to correct this issue. | |||||
| CVE-2026-56707 | 2026-08-31 | N/A | 7.7 HIGH | ||
| Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel. | |||||
| CVE-2026-80193 | 2026-08-31 | N/A | 8.8 HIGH | ||
| Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere. | |||||
| CVE-2026-76876 | 2026-08-31 | N/A | 5.9 MEDIUM | ||
| Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification. | |||||