Total
9880 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-6470 | 1 Postgresql | 1 Postgresql | 2026-08-29 | N/A | 4.3 MEDIUM |
| Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. | |||||
| CVE-2026-80346 | 2026-08-28 | N/A | 7.1 HIGH | ||
| StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one. | |||||
| CVE-2026-82279 | 2026-08-28 | N/A | 8.1 HIGH | ||
| HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints. | |||||
| CVE-2026-82273 | 2026-08-28 | N/A | 6.5 MEDIUM | ||
| Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners. | |||||
| CVE-2026-70550 | 2026-08-28 | N/A | 6.5 MEDIUM | ||
| An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions. | |||||
| CVE-2026-65926 | 2026-08-28 | N/A | 3.1 LOW | ||
| An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known. | |||||
| CVE-2026-69104 | 2026-08-28 | N/A | 7.6 HIGH | ||
| An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue. | |||||
| CVE-2026-19200 | 2026-08-28 | N/A | 8.9 HIGH | ||
| The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function. | |||||
| CVE-2026-64954 | 2026-08-28 | N/A | 8.2 HIGH | ||
| Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role. | |||||
| CVE-2026-18652 | 2026-08-28 | N/A | 6.5 MEDIUM | ||
| Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a user with read access to the root org can access result sets from child orgs. | |||||
| CVE-2026-82245 | 2026-08-28 | N/A | 8.1 HIGH | ||
| Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/* endpoints to disable premium features and downgrade deployments for all users. | |||||
| CVE-2026-82240 | 2026-08-28 | N/A | 8.1 HIGH | ||
| Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps fields to escalate privileges and gain unauthorized builder access to other applications in the same tenant. | |||||
| CVE-2026-82239 | 2026-08-28 | N/A | 8.1 HIGH | ||
| Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data. | |||||
| CVE-2026-81767 | 2026-08-28 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions. | |||||
| CVE-2026-81761 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in WpEvently <= 5.5.0 versions. | |||||
| CVE-2026-81759 | 2026-08-28 | N/A | 5.4 MEDIUM | ||
| Contributor Broken Access Control in WpEvently <= 5.5.0 versions. | |||||
| CVE-2026-81284 | 2026-08-28 | N/A | 4.3 MEDIUM | ||
| Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions. | |||||
| CVE-2026-81276 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions. | |||||
| CVE-2026-80433 | 2026-08-28 | N/A | 7.5 HIGH | ||
| Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions. | |||||
| CVE-2026-82242 | 2026-08-28 | N/A | 7.7 HIGH | ||
| Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications. | |||||