Total
4691 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-71247 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here. | |||||
| CVE-2026-73049 | 2026-08-26 | N/A | 5.8 MEDIUM | ||
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents. | |||||
| CVE-2026-73059 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes. | |||||
| CVE-2026-58443 | 2026-08-26 | N/A | 9.1 CRITICAL | ||
| Public-only repository tokens can update private PR head branches | |||||
| CVE-2026-58427 | 2026-08-26 | N/A | 7.5 HIGH | ||
| Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | |||||
| CVE-2026-55987 | 2026-08-26 | N/A | 8.1 HIGH | ||
| OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | |||||
| CVE-2026-24791 | 2026-08-26 | N/A | 8.1 HIGH | ||
| Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | |||||
| CVE-2026-58425 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | |||||
| CVE-2026-57897 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | |||||
| CVE-2026-56443 | 2026-08-26 | N/A | 9.6 CRITICAL | ||
| Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | |||||
| CVE-2026-58416 | 2026-08-26 | N/A | 7.1 HIGH | ||
| Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | |||||
| CVE-2026-58444 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | |||||
| CVE-2026-58431 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| Public-only API token restriction is not enforced on team API routes | |||||
| CVE-2026-15254 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site. | |||||
| CVE-2026-14929 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site. | |||||
| CVE-2026-16540 | 2026-08-26 | N/A | 7.5 HIGH | ||
| The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them. | |||||
| CVE-2026-16064 | 2026-08-26 | N/A | 5.4 MEDIUM | ||
| The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own. | |||||
| CVE-2026-15939 | 2026-08-26 | N/A | 2.7 LOW | ||
| The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to. | |||||
| CVE-2026-15229 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation. | |||||
| CVE-2026-19699 | 2026-08-26 | N/A | 2.7 LOW | ||
| The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account. | |||||