Total
11421 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-50284 | 2026-10-25 | N/A | N/A | ||
| Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22. | |||||
| CVE-2026-57760 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29. | |||||
| CVE-2026-57731 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Contributor Broken Access Control in Flatsome <= 3.20.5 versions. | |||||
| CVE-2026-57688 | 2026-10-25 | N/A | 8.2 HIGH | ||
| Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions. | |||||
| CVE-2026-57669 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions. | |||||
| CVE-2026-58167 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems. | |||||
| CVE-2026-12557 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read all plugin debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table. | |||||
| CVE-2026-57335 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions. | |||||
| CVE-2026-57340 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions. | |||||
| CVE-2026-57334 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. | |||||
| CVE-2026-9132 | 1 Github | 1 Enterprise Server | 2026-10-25 | N/A | 6.5 MEDIUM |
| A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program. | |||||
| CVE-2026-50282 | 2026-10-25 | N/A | N/A | ||
| Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14. | |||||
| CVE-2026-57746 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Subscriber Broken Access Control in Booked <= 3.0.0 versions. | |||||
| CVE-2026-57498 | 2026-10-25 | N/A | 9.6 CRITICAL | ||
| Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474. | |||||
| CVE-2026-57353 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. | |||||
| CVE-2026-57952 | 1 Its-a-feature | 1 Mythic | 2026-10-25 | N/A | 5.3 MEDIUM |
| Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpoints with a known payload UUID from another operation to access that operation's C2 profile configuration including encryption keys and callback parameters. | |||||
| CVE-2026-57954 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths. | |||||
| CVE-2026-58448 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification. | |||||
| CVE-2026-57730 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Flatsome <= 3.20.5 versions. | |||||
| CVE-2026-14460 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from <= 1.0.4 before 1.0.5. | |||||