Total
11505 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-69107 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 5.9 MEDIUM |
| An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions. | |||||
| CVE-2026-69115 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts. | |||||
| CVE-2026-59113 | 1 Microsoft | 1 Visual Studio Code | 2026-10-24 | N/A | 8.8 HIGH |
| Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-66466 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions. | |||||
| CVE-2026-70340 | 1 Microsoft | 1 Azure Cyclecloud | 2026-10-24 | N/A | 8.1 HIGH |
| Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-58244 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access the users account information in the application, which could be leveraged to facilitate further attacks against the identified user accounts. This vulnerability results in low impact on confidentiality of the data, with no impact on the integrity and availability | |||||
| CVE-2026-66378 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 4.3 MEDIUM |
| An authenticated user without repository read permission may access private NuGet metadata under specific conditions. | |||||
| CVE-2026-66060 | 2026-10-24 | N/A | 7.1 HIGH | ||
| Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1. | |||||
| CVE-2026-66678 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions. | |||||
| CVE-2026-70436 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to read files in workspaces they are not authorized to access. | |||||
| CVE-2026-64954 | 2026-10-24 | N/A | 8.2 HIGH | ||
| Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role. | |||||
| CVE-2026-70439 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality. | |||||
| CVE-2026-66380 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 4.3 MEDIUM |
| An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. | |||||
| CVE-2026-66701 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions. | |||||
| CVE-2026-66061 | 2026-10-24 | N/A | 7.1 HIGH | ||
| Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0. | |||||
| CVE-2026-13229 | 2026-10-24 | N/A | N/A | ||
| Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint. | |||||
| CVE-2026-54201 | 2026-10-24 | N/A | N/A | ||
| Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. | |||||
| CVE-2026-70445 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-66377 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 5.3 MEDIUM |
| An unauthenticated user may access restricted repository information under specific conditions. | |||||
| CVE-2026-70446 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||