Total
11504 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-25714 | 2026-10-25 | N/A | 4.3 MEDIUM | ||
| Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941. | |||||
| CVE-2026-13236 | 1 Artificial Intelligence Project | 1 Artificial Intelligence | 2026-10-25 | N/A | 4.2 MEDIUM |
| Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1. | |||||
| CVE-2026-15320 | 2026-10-25 | 5.5 MEDIUM | 5.4 MEDIUM | ||
| A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The reported GitHub issue was closed automatically due to inactivity. | |||||
| CVE-2026-54329 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 8.5 HIGH |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-15332 | 2026-10-25 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unknown function of the file channel/channel.py of the component Message Endpoint. The manipulation results in missing authorization. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-13235 | 1 Artificial Intelligence Project | 1 Artificial Intelligence | 2026-10-25 | N/A | 3.3 LOW |
| Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3. | |||||
| CVE-2026-61442 | 2026-10-25 | N/A | 7.1 HIGH | ||
| PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route's owner/admin permission check. | |||||
| CVE-2026-13240 | 1 Md-systems | 1 Paragraphs | 2026-10-25 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. | |||||
| CVE-2026-10768 | 1 Localgovdrupal | 1 Localgov Workflows | 2026-10-25 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0. | |||||
| CVE-2026-27771 | 2026-10-25 | N/A | 8.2 HIGH | ||
| Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. | |||||
| CVE-2026-55638 | 2026-10-25 | N/A | 8.6 HIGH | ||
| 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider credentials. This issue is fixed in version 0.5.2. | |||||
| CVE-2026-6509 | 2026-10-25 | N/A | 7.8 HIGH | ||
| Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation. This issue affects Pardus Update: from <=0.6.3 before 0.6.6. | |||||
| CVE-2026-59796 | 1 Jetbrains | 1 Teamcity | 2026-10-24 | N/A | 8.1 HIGH |
| In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks | |||||
| CVE-2026-57740 | 2026-10-24 | N/A | 7.1 HIGH | ||
| Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.1. | |||||
| CVE-2026-58410 | 2026-10-24 | N/A | 7.1 HIGH | ||
| ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-privileged users to read and modify other families’ records. An authenticated non-admin user with EditSelf access can supply another family’s `familyId` and access records outside their own family scope. The backend trusts the attacker-controlled `familyId` and loads the corresponding family entity by ID without verifying that the requested family belongs to the current user. If the same user also has Notes permission, they can create notes on another family’s record. This breaks the intended EditSelf scope and allows access to unrelated congregation records. This issue has been fixed in version 7.4.0. | |||||
| CVE-2026-57400 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets Manager for WooCommerce: from n/a through <= 1.5.5. | |||||
| CVE-2026-15752 | 2026-10-24 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 19fc3282a1bb78a05c34945c088525d20e081cbd. Applying a patch is the recommended action to fix this issue. | |||||
| CVE-2026-57424 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through <= 2.1.4. | |||||
| CVE-2026-61983 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30. | |||||
| CVE-2026-57729 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5. | |||||