Total
11505 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-65554 | 2026-10-24 | N/A | 7.1 HIGH | ||
| Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. | |||||
| CVE-2026-13227 | 2026-10-24 | N/A | N/A | ||
| An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0. | |||||
| CVE-2026-65675 | 1 Microsoft | 2 Github Copilot Chat, Visual Studio Code | 2026-10-24 | N/A | 7.1 HIGH |
| No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-65541 | 2026-10-24 | N/A | 7.3 HIGH | ||
| Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. | |||||
| CVE-2026-67621 | 1 Flowiseai | 1 Flowise | 2026-10-24 | N/A | 7.6 HIGH |
| Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows. | |||||
| CVE-2026-66689 | 2026-10-24 | N/A | 6.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions. | |||||
| CVE-2026-65551 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7. | |||||
| CVE-2026-70447 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-66452 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions. | |||||
| CVE-2026-65806 | 1 Microsoft | 1 Azure Cyclecloud | 2026-10-24 | N/A | 6.5 MEDIUM |
| Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network. | |||||
| CVE-2026-56720 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check. | |||||
| CVE-2026-66464 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions. | |||||
| CVE-2026-66772 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability. | |||||
| CVE-2026-61984 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | |||||
| CVE-2026-65504 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. | |||||
| CVE-2026-66708 | 2026-10-24 | N/A | 8.2 HIGH | ||
| Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. | |||||
| CVE-2026-68753 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 5.3 MEDIUM |
| An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. | |||||
| CVE-2026-70636 | 1 Flowiseai | 1 Flowise | 2026-10-24 | N/A | 7.5 HIGH |
| Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273. | |||||
| CVE-2026-73605 | 2026-10-24 | N/A | 5.8 MEDIUM | ||
| SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software. | |||||
| CVE-2026-72759 | 2026-10-24 | N/A | N/A | ||
| In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission | |||||