Total
9895 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-48169 | 2026-08-11 | N/A | 8.8 HIGH | ||
| PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires `min_role="member"`, which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls `workspace_id` from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The `require_workspace_member()` dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue. | |||||
| CVE-2020-36890 | 1 Kentico | 1 Xperience | 2026-08-10 | N/A | 7.2 HIGH |
| An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels. | |||||
| CVE-2025-8361 | 1 Config Pages Project | 1 Config Pages | 2026-08-10 | N/A | 7.6 HIGH |
| Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing. This issue affects Config Pages: from 0.0.0 before 2.18.0. | |||||
| CVE-2026-13692 | 2026-08-10 | N/A | 5.3 MEDIUM | ||
| The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders. | |||||
| CVE-2026-54415 | 2026-08-10 | N/A | 8.1 HIGH | ||
| Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}). | |||||
| CVE-2026-58275 | 1 Microsoft | 1 Azure Dns | 2026-08-07 | N/A | 10.0 CRITICAL |
| Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-62830 | 1 Microsoft | 1 Azure Sre Agent | 2026-08-07 | N/A | 9.9 CRITICAL |
| Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-18208 | 1 Redhat | 1 Build Of Keycloak | 2026-08-07 | N/A | 6.5 MEDIUM |
| A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token. | |||||
| CVE-2026-47688 | 1 Fogproject | 1 Fogproject | 2026-08-07 | N/A | 8.2 HIGH |
| FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue. | |||||
| CVE-2026-6235 | 2026-08-06 | N/A | 9.8 CRITICAL | ||
| The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails). | |||||
| CVE-2025-14843 | 2026-08-06 | N/A | 5.3 MEDIUM | ||
| The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.3.1. This is due to a lack of authentication and authorization checks in the 'handle_checkout_redirecturl_response' function. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by sending a crafted request with a valid order ID. | |||||
| CVE-2026-66326 | 1 Microsoft | 1 Edge Chromium | 2026-08-06 | N/A | 6.5 MEDIUM |
| Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-66311 | 1 Microsoft | 1 Edge Chromium | 2026-08-06 | N/A | 6.2 MEDIUM |
| Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. | |||||
| CVE-2026-63141 | 1 Elastic | 1 Kibana | 2026-08-06 | N/A | 6.3 MEDIUM |
| Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints. | |||||
| CVE-2026-10768 | 1 Localgovdrupal | 1 Localgov Workflows | 2026-08-06 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0. | |||||
| CVE-2026-11909 | 1 Rfay | 1 Examples For Developers | 2026-08-06 | N/A | 3.3 LOW |
| Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6. | |||||
| CVE-2026-13239 | 1 Wiss-ki | 1 Wisski | 2026-08-06 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0. | |||||
| CVE-2026-3524 | 1 Mattermost | 1 Legal Hold | 2026-08-06 | N/A | 8.8 HIGH |
| Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621 | |||||
| CVE-2026-49326 | 1 Apache | 1 Hbase | 2026-08-06 | N/A | 6.5 MEDIUM |
| Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue. | |||||
| CVE-2026-58080 | 1 Eclipse | 1 Milo | 2026-08-05 | N/A | 8.2 HIGH |
| In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes. | |||||