Total
11506 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-72759 | 2026-10-24 | N/A | N/A | ||
| In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission | |||||
| CVE-2026-70547 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 4.3 MEDIUM |
| An authenticated user without repository read permission may access package metadata under specific conditions. | |||||
| CVE-2026-72798 | 2026-10-24 | N/A | 8.6 HIGH | ||
| SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type. | |||||
| CVE-2026-70475 | 1 Flowiseai | 1 Flowise | 2026-10-24 | N/A | 6.5 MEDIUM |
| Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3. | |||||
| CVE-2026-72906 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0. | |||||
| CVE-2026-72789 | 2026-10-24 | N/A | 8.6 HIGH | ||
| SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material. | |||||
| CVE-2026-73140 | 2026-10-24 | N/A | N/A | ||
| Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges, build_evaluation_report() previously included all evaluation comments without applying those rules. Consequently, a user who was authorized to view a conversion could export its evaluation report as Markdown or PDF and obtain private evaluation comments that should only have been visible to the conversion owner, the comment author, or an administrator. The leaked report data also contained the comment author's name. The fix passes the requesting user into the report builder and filters every evaluation comment using the shared access.can_see_comment() authorization function. | |||||
| CVE-2026-73155 | 2026-10-24 | N/A | N/A | ||
| Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react() handler passed an attacker-controlled comment_id directly to comments_repo.toggle_reaction() after only validating that the ID existed syntactically and that the requested emoji was permitted. Because comment-level visibility was not enforced, a user who could identify the ID of a private or otherwise inaccessible comment could modify reaction state on that comment despite lacking permission to access it. The fix retrieves the target comment, rejects missing or deleted comments, retrieves its associated conversion, and enforces access.can_see_comment(current_user, comment, conversion). Unauthorized requests now receive HTTP 403. | |||||
| CVE-2026-73403 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. | |||||
| CVE-2026-72797 | 2026-10-24 | N/A | 5.8 MEDIUM | ||
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their current unlock status, revealing sensitive notebook names and decryption state in memory. | |||||
| CVE-2026-73249 | 2026-10-24 | N/A | 7.5 HIGH | ||
| calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0. | |||||
| CVE-2026-73296 | 2026-10-24 | N/A | 9.4 CRITICAL | ||
| Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state. This issue is fixed in version 3.0.8. | |||||
| CVE-2026-71252 | 2026-10-24 | N/A | 8.2 HIGH | ||
| toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views. | |||||
| CVE-2026-72910 | 2026-10-24 | N/A | 7.1 HIGH | ||
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0. | |||||
| CVE-2026-72692 | 2026-10-24 | N/A | 7.5 HIGH | ||
| A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document. | |||||
| CVE-2026-73607 | 2026-10-24 | N/A | 5.8 MEDIUM | ||
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester. | |||||
| CVE-2026-71264 | 2026-10-24 | N/A | 8.2 HIGH | ||
| WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. | |||||
| CVE-2026-73353 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions. | |||||
| CVE-2026-72800 | 2026-10-24 | N/A | 5.8 MEDIUM | ||
| SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText and getBlockRelevantIDs endpoints enumerate workspace-wide block IDs without publish scoping, enabling attackers to discover valid block identifiers across publish boundaries and access content from hidden or password-protected documents. | |||||
| CVE-2026-72790 | 2026-10-24 | N/A | 5.8 MEDIUM | ||
| SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers. | |||||