Total
11496 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-57688 | 2026-10-25 | N/A | 8.2 HIGH | ||
| Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions. | |||||
| CVE-2026-57669 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions. | |||||
| CVE-2026-58167 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems. | |||||
| CVE-2026-12557 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read all plugin debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table. | |||||
| CVE-2026-57335 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions. | |||||
| CVE-2026-57340 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions. | |||||
| CVE-2026-57334 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. | |||||
| CVE-2026-9132 | 1 Github | 1 Enterprise Server | 2026-10-25 | N/A | 6.5 MEDIUM |
| A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program. | |||||
| CVE-2026-50282 | 2026-10-25 | N/A | N/A | ||
| Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14. | |||||
| CVE-2026-57746 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Subscriber Broken Access Control in Booked <= 3.0.0 versions. | |||||
| CVE-2026-57498 | 2026-10-25 | N/A | 9.6 CRITICAL | ||
| Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474. | |||||
| CVE-2026-57353 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. | |||||
| CVE-2026-57952 | 1 Its-a-feature | 1 Mythic | 2026-10-25 | N/A | 5.3 MEDIUM |
| Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpoints with a known payload UUID from another operation to access that operation's C2 profile configuration including encryption keys and callback parameters. | |||||
| CVE-2026-57954 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths. | |||||
| CVE-2026-58448 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation. Attackers can query any process-instance identifier through the unguarded GET endpoint to read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification. | |||||
| CVE-2026-57730 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Flatsome <= 3.20.5 versions. | |||||
| CVE-2026-14460 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from <= 1.0.4 before 1.0.5. | |||||
| CVE-2026-27433 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85. | |||||
| CVE-2026-57949 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users' follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks. | |||||
| CVE-2026-57946 | 2026-10-25 | N/A | 3.7 LOW | ||
| Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication. | |||||