Total
11503 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-27435 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woffice: from n/a before 5.4.33. | |||||
| CVE-2026-14156 | 1 Google | 1 Chrome | 2026-10-25 | N/A | 6.5 MEDIUM |
| Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-57640 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions. | |||||
| CVE-2026-55542 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 4.3 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch. Version 8.6.1 contains a patch. | |||||
| CVE-2026-57654 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions. | |||||
| CVE-2026-57720 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThumbPress: from n/a through 6.3.2. | |||||
| CVE-2026-33802 | 1 Juniper | 6 Ex2300, Ex4000, Ex4100 and 3 more | 2026-10-25 | N/A | 5.5 MEDIUM |
| A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a local, authenticated attacker to cause a Denial-of-Service (DoS). On EX2300, EX4000, EX4100, EX4300-MP (Multigigabit) and EX4400 switches, an authenticated, local attacker with no specific permissions or class can execute a specific, privileged CLI 'request' command which will cause complete traffic impact until the system automatically recovers. This issue affects Junos OS on EX2300, EX4000, EX4100, EX4300-MP (Multigigabit) and EX4400: * 23.2R2 versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S8, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2-S3, * 25.2 versions before 25.2R2, * 25.4 versions before 25.4R1-S1. | |||||
| CVE-2026-57721 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ApplyOnline: from n/a through 2.6.7.6. | |||||
| CVE-2026-57649 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions. | |||||
| CVE-2026-54004 | 2026-10-25 | N/A | N/A | ||
| Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4. | |||||
| CVE-2026-12411 | 1 Canonical | 1 Lxd | 2026-10-25 | N/A | 8.4 HIGH |
| Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled. | |||||
| CVE-2026-57648 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Contributor Broken Access Control in Nelio Content <= 4.3.4 versions. | |||||
| CVE-2026-54005 | 2026-10-25 | N/A | N/A | ||
| Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenticated users who know or guess page IDs or UUIDs to retrieve page information, including full content and metadata, for arbitrary published pages through the /api/site/find route without authorization to access those pages. This issue is fixed in versions 4.9.4 and 5.4.4. | |||||
| CVE-2026-59805 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke_access and undo_revoke_access actions without seller ownership validation. Attackers can modify the is_access_revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own. | |||||
| CVE-2026-57661 | 2026-10-25 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions. | |||||
| CVE-2026-57645 | 2026-10-25 | N/A | 8.1 HIGH | ||
| newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions. | |||||
| CVE-2026-54695 | 1 Pipecat | 1 Pipecat | 2026-10-25 | N/A | 7.5 HIGH |
| Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo. This issue is fixed in version 1.4.0. | |||||
| CVE-2026-57660 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions. | |||||
| CVE-2026-12593 | 2026-10-25 | N/A | N/A | ||
| The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker), the attacker knowing its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker would then have had to forge a token creation API request on behalf of the other user and could have authenticated and finalized the token creation with their own OAuth/OIDC credentials. In the worst case, this would mean an attacker could have become Dashboard Administrator and been able to perform all administrative actions if the preexisting internal user had administrative privileges. In combination with a separate weakness, this could have further led to code execution on the host system running the Dashboard with the privileges of the OS-User running the Dashboard server. | |||||
| CVE-2026-48492 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 6.5 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch. | |||||