Total
11504 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-69113 | 2026-10-24 | N/A | 5.4 MEDIUM | ||
| Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences. | |||||
| CVE-2026-53996 | 2026-10-24 | N/A | 7.0 HIGH | ||
| NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attackers can repeatedly issue HDAUDIO_FGRP_SETCONFIG from one thread while keeping DMA and IRQs live from a second thread to trigger a use-after-free race condition in hdafg_detach() between stream_stop() and stream_disestablish(), where a latched DMA interrupt dereferences a freed callback pointer, resulting in outcomes ranging from audio-subsystem denial of service and kernel panic to potential local kernel privilege escalation. | |||||
| CVE-2026-66441 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions. | |||||
| CVE-2026-66660 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions. | |||||
| CVE-2026-63300 | 1 Canonical | 1 Lxd | 2026-10-24 | N/A | 9.9 CRITICAL |
| An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project. | |||||
| CVE-2026-32548 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions. | |||||
| CVE-2026-65667 | 1 Microsoft | 1 Teams | 2026-10-24 | N/A | 10.0 CRITICAL |
| Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-68758 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 6.5 MEDIUM |
| A low-privileged authenticated user may access restricted support information under specific conditions. | |||||
| CVE-2026-66470 | 2026-10-24 | N/A | 7.1 HIGH | ||
| Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions. | |||||
| CVE-2026-66699 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Custom role Broken Access Control in Dokan <= 5.0.10 versions. | |||||
| CVE-2026-66375 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 8.1 HIGH |
| A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions. | |||||
| CVE-2026-64662 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished entries, through the navigation endpoint, though no data could be modified. This issue is fixed in versions 5.74.1 and 6.24.0. | |||||
| CVE-2026-70438 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-65938 | 1 Progress | 1 Whatsup Gold | 2026-10-24 | N/A | 4.3 MEDIUM |
| In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions. | |||||
| CVE-2026-58237 | 1 Sap | 1 Approuter | 2026-10-24 | N/A | 5.9 MEDIUM |
| WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability. | |||||
| CVE-2026-62830 | 1 Microsoft | 1 Azure Sre Agent | 2026-10-24 | N/A | 9.9 CRITICAL |
| Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-65926 | 2026-10-24 | N/A | 3.1 LOW | ||
| An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known. | |||||
| CVE-2026-66469 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | |||||
| CVE-2026-58241 | 2026-10-24 | N/A | 4.2 MEDIUM | ||
| SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on the integrity and availability of the application with no impact on confidentiality. | |||||
| CVE-2026-69107 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 5.9 MEDIUM |
| An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions. | |||||