Total
4807 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-111332 | 2026-10-23 | N/A | 3.7 LOW | ||
| OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password. | |||||
| CVE-2026-21077 | 1 Samsung | 1 Health | 2026-10-23 | N/A | 5.5 MEDIUM |
| Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | |||||
| CVE-2026-21076 | 1 Samsung | 1 Health | 2026-10-23 | N/A | 5.5 MEDIUM |
| Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | |||||
| CVE-2026-19350 | 2026-10-23 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue. | |||||
| CVE-2026-19345 | 2026-10-23 | 6.4 MEDIUM | 6.5 MEDIUM | ||
| A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. | |||||
| CVE-2026-18171 | 2026-10-23 | N/A | N/A | ||
| Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only. | |||||
| CVE-2026-113876 | 2026-10-23 | N/A | 4.3 MEDIUM | ||
| SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents. | |||||
| CVE-2026-113874 | 2026-10-23 | N/A | 8.1 HIGH | ||
| SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition. | |||||
| CVE-2026-13737 | 1 Commvault | 1 Commvault | 2026-10-23 | N/A | 9.8 CRITICAL |
| CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X. | |||||
| CVE-2026-18635 | 2026-10-23 | N/A | 7.2 HIGH | ||
| Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org. This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission. | |||||
| CVE-2026-27302 | 1 Adobe | 1 Campaign | 2026-10-23 | N/A | 10.0 CRITICAL |
| Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-13738 | 1 Commvault | 1 Commvault | 2026-10-23 | N/A | 9.8 CRITICAL |
| CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X. | |||||
| CVE-2026-18348 | 2026-10-23 | N/A | 4.1 MEDIUM | ||
| Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints. | |||||
| CVE-2026-48447 | 2 Adobe, Microsoft | 2 Lightroom, Windows | 2026-10-23 | N/A | 7.7 HIGH |
| Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | |||||
| CVE-2026-110806 | 1 Devolutions | 1 Devolutions Server | 2026-10-23 | N/A | 6.5 MEDIUM |
| Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data. | |||||
| CVE-2026-110287 | 1 Devolutions | 1 Devolutions Server | 2026-10-23 | N/A | 4.3 MEDIUM |
| Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint. | |||||
| CVE-2026-109433 | 2026-10-23 | N/A | 6.5 MEDIUM | ||
| Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants. | |||||
| CVE-2026-115370 | 2026-10-23 | N/A | 4.3 MEDIUM | ||
| Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services. | |||||
| CVE-2026-114623 | 2026-10-23 | N/A | 6.5 MEDIUM | ||
| baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2. | |||||
| CVE-2026-75480 | 2026-10-23 | N/A | 6.5 MEDIUM | ||
| OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges. | |||||