Total
4805 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-106623 | 1 Adobe | 1 Coldfusion | 2026-10-17 | N/A | 7.5 HIGH |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-77361 | 2026-10-16 | N/A | 4.7 MEDIUM | ||
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied folder can therefore bypass the read ACL and expose files in the denied folder. Exploitation requires an out-of-band-planted symlink and does not permit an escape from the vault root. Version 1.3.1 fixes the vulnerability by applying ACL checks to the resolved vault-relative path. | |||||
| CVE-2026-111666 | 2026-10-16 | N/A | 4.3 MEDIUM | ||
| Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names. | |||||
| CVE-2026-111688 | 2026-10-16 | N/A | 4.3 MEDIUM | ||
| Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope. | |||||
| CVE-2026-105994 | 1 Adobe | 1 Coldfusion | 2026-10-16 | N/A | 7.7 HIGH |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-106089 | 1 Adobe | 1 Coldfusion | 2026-10-16 | N/A | 8.8 HIGH |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-106090 | 1 Adobe | 1 Coldfusion | 2026-10-16 | N/A | 8.8 HIGH |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-105901 | 1 Adobe | 1 Coldfusion | 2026-10-16 | N/A | 8.8 HIGH |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-88755 | 2026-10-16 | N/A | 7.8 HIGH | ||
| Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository. | |||||
| CVE-2026-111627 | 2026-10-16 | N/A | 7.2 HIGH | ||
| HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account. | |||||
| CVE-2026-111235 | 2026-10-16 | N/A | 9.1 CRITICAL | ||
| An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. | |||||
| CVE-2026-107851 | 2026-10-16 | N/A | 4.3 MEDIUM | ||
| Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12. | |||||
| CVE-2026-108263 | 2026-10-16 | N/A | 9.9 CRITICAL | ||
| Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2. | |||||
| CVE-2026-108388 | 2026-10-16 | N/A | 3.5 LOW | ||
| Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14. | |||||
| CVE-2026-15577 | 2026-10-16 | N/A | 6.5 MEDIUM | ||
| A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled. | |||||
| CVE-2026-85298 | 2026-10-16 | N/A | N/A | ||
| An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed. | |||||
| CVE-2026-93294 | 2026-10-16 | N/A | 6.3 MEDIUM | ||
| A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity. | |||||
| CVE-2026-110904 | 2026-10-16 | N/A | 5.3 MEDIUM | ||
| ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call. | |||||
| CVE-2026-110451 | 2026-10-16 | N/A | 4.3 MEDIUM | ||
| Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled. | |||||
| CVE-2026-104355 | 2026-10-16 | N/A | N/A | ||
| A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed. | |||||