Total
11503 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-57632 | 2026-10-25 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions. | |||||
| CVE-2026-12471 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set of plugins. | |||||
| CVE-2026-49274 | 2026-10-25 | N/A | N/A | ||
| Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4. | |||||
| CVE-2026-13537 | 2026-10-25 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely. The exploit has been made public and could be used. | |||||
| CVE-2026-44734 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or permission level. An attacker who discovers or guesses a public report's numeric ID can rename or overwrite its filter configuration without any warning to the report's owner. This vulnerability is fixed in 17.3.2 and 17.4.0. | |||||
| CVE-2026-47193 | 2026-10-25 | N/A | 7.5 HIGH | ||
| OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1. | |||||
| CVE-2026-27409 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webba Booking: from n/a through 6.4.13. | |||||
| CVE-2026-55476 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 4.3 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0. | |||||
| CVE-2026-27783 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints. | |||||
| CVE-2026-25038 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Gitea 1.26.2 allows unauthorized users to access labels of private organizations. | |||||
| CVE-2026-59853 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents. This issue is fixed in versions 3.7.1. | |||||
| CVE-2026-57221 | 1 Broadcom | 1 Rabbitmq Server | 2026-10-25 | N/A | 5.0 MEDIUM |
| RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. | |||||
| CVE-2026-44918 | 2026-10-25 | N/A | 5.5 MEDIUM | ||
| OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. | |||||
| CVE-2026-58589 | 1 Flowdrop Project | 1 Flowdrop | 2026-10-25 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. | |||||
| CVE-2026-61441 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a dependency through an owner-created issue endpoint (which returns 403) can delete the same dependency edge by targeting a related member-owned issue endpoint, because permission is validated against the member-owned issue's owner. This allows members to bypass owner/admin authorization and remove owner-created issue dependencies. | |||||
| CVE-2026-11909 | 1 Rfay | 1 Examples For Developers | 2026-10-25 | N/A | 3.3 LOW |
| Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6. | |||||
| CVE-2026-13241 | 1 Md-systems | 1 Paragraphs | 2026-10-25 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. | |||||
| CVE-2026-13239 | 1 Wiss-ki | 1 Wisski | 2026-10-25 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0. | |||||
| CVE-2026-58590 | 1 Flowdrop Project | 1 Flowdrop | 2026-10-25 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. | |||||
| CVE-2026-25714 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941. | |||||