Total
11496 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-57293 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-45677 | 2026-10-25 | N/A | N/A | ||
| Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML integration does not verify the signature on inbound LogoutRequest messages. An unauthenticated remote attacker who knows a target user's SAML NameID - which major identity providers (Okta, Google Workspace, Microsoft Entra ID, JumpCloud) expose as the user's email address - can craft a valid-looking unsigned LogoutRequest and submit it to the SP logout endpoint. The server processes it as legitimate, immediately destroying the victim's session. Because the attack requires no authentication and no interaction from the victim, it can be repeated in a loop against individual users or scripted across many accounts, effectively rendering the Rocket.Chat instance unusable for SAML-authenticated users. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. | |||||
| CVE-2026-57925 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags | |||||
| CVE-2026-57300 | 1 Jenkins | 1 Mcp Server | 2026-10-25 | N/A | 4.3 MEDIUM |
| A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. | |||||
| CVE-2026-57297 | 1 Jenkins | 1 Contrast Continuous Application Security | 2026-10-25 | N/A | 4.3 MEDIUM |
| A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key. | |||||
| CVE-2026-57521 | 1 Bitwarden | 1 Server | 2026-10-25 | N/A | 4.3 MEDIUM |
| Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data. | |||||
| CVE-2026-52701 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. | |||||
| CVE-2026-57299 | 1 Jenkins | 1 Contrast Continuous Application Security | 2026-10-25 | N/A | 4.3 MEDIUM |
| Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata. | |||||
| CVE-2026-57922 | 1 Jetbrains | 1 Youtrack | 2026-10-25 | N/A | 3.1 LOW |
| In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible | |||||
| CVE-2026-57294 | 1 Jenkins | 1 Ec2 Fleet | 2026-10-25 | N/A | 5.4 MEDIUM |
| A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. | |||||
| CVE-2026-58373 | 1 Cvat | 1 Computer Vision Annotation Tool | 2026-10-25 | N/A | 4.3 MEDIUM |
| CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check_object_permissions call on the parent_id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent_id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content. | |||||
| CVE-2026-57750 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions. | |||||
| CVE-2026-57689 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions. | |||||
| CVE-2026-57355 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions. | |||||
| CVE-2026-50283 | 2026-10-25 | N/A | N/A | ||
| Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId. AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads: assetId -> $assetToReplace and sourceAssetId -> $sourceAsset, then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume. When both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no deletion check for for the source asset. An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId, leading to broken content references and data loss. This issue has been fixed in versions 4.17.14 and 5.9.21. | |||||
| CVE-2026-57339 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions. | |||||
| CVE-2026-57332 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions. | |||||
| CVE-2026-50284 | 2026-10-25 | N/A | N/A | ||
| Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22. | |||||
| CVE-2026-57760 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29. | |||||
| CVE-2026-57731 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Contributor Broken Access Control in Flatsome <= 3.20.5 versions. | |||||