Total
11506 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-66477 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Gillion <= 4.13 versions. | |||||
| CVE-2026-59547 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions. | |||||
| CVE-2026-47755 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue. | |||||
| CVE-2026-65453 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | |||||
| CVE-2026-61943 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions. | |||||
| CVE-2026-53850 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 5.5 MEDIUM |
| OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority, potentially enabling unauthorized operations depending on gateway configuration and input trust levels. | |||||
| CVE-2026-61973 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions. | |||||
| CVE-2026-59560 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. | |||||
| CVE-2026-65457 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions. | |||||
| CVE-2026-62191 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 7.1 HIGH |
| OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable. | |||||
| CVE-2026-62205 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 7.1 HIGH |
| OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. The issue is fixed in 2026.6.6. | |||||
| CVE-2026-65468 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions. | |||||
| CVE-2026-57808 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions. | |||||
| CVE-2026-27355 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. | |||||
| CVE-2026-65487 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. | |||||
| CVE-2026-65916 | 2026-10-24 | N/A | 8.1 HIGH | ||
| CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status files, and remove database records belonging to other tenants. | |||||
| CVE-2026-27392 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Contributor Broken Access Control in uListing <= 2.2.0 versions. | |||||
| CVE-2026-65531 | 2026-10-24 | N/A | 4.8 MEDIUM | ||
| Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. | |||||
| CVE-2026-57367 | 2026-10-24 | N/A | 7.1 HIGH | ||
| Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions. | |||||
| CVE-2026-64814 | 1 Jetbrains | 1 Intellij Idea | 2026-10-24 | N/A | 8.6 HIGH |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session | |||||