Total
11506 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-65499 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions. | |||||
| CVE-2026-49326 | 1 Apache | 1 Hbase | 2026-10-24 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue. | |||||
| CVE-2026-66027 | 2026-10-24 | N/A | 8.3 HIGH | ||
| Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue, causing the background drainer to forward malicious messages to the victim's running AI agent with the victim's credentials and permissions. | |||||
| CVE-2026-27377 | 2026-10-24 | N/A | 6.7 MEDIUM | ||
| Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions. | |||||
| CVE-2026-61972 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions. | |||||
| CVE-2026-65472 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions. | |||||
| CVE-2026-65524 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. | |||||
| CVE-2026-65452 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | |||||
| CVE-2026-57425 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions. | |||||
| CVE-2026-65506 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions. | |||||
| CVE-2026-16799 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | N/A | 5.0 MEDIUM |
| Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks. | |||||
| CVE-2026-59534 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | |||||
| CVE-2026-59522 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in WP ERP <= 1.17.5 versions. | |||||
| CVE-2026-61954 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions. | |||||
| CVE-2026-58275 | 1 Microsoft | 1 Azure Dns | 2026-10-24 | N/A | 10.0 CRITICAL |
| Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-65478 | 2026-10-24 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in ListingPro <= 2.9.10 versions. | |||||
| CVE-2026-65895 | 2026-10-24 | N/A | 8.5 HIGH | ||
| Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled. | |||||
| CVE-2026-65922 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 7.1 HIGH |
| An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected. | |||||
| CVE-2026-59535 | 2026-10-24 | N/A | 7.3 HIGH | ||
| Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. | |||||
| CVE-2026-65445 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. | |||||