CVE-2026-109892 | Critical | 9.8 | 2026-10-15 | Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue aff… |
CVE-2026-109693 | High | 8.8 | 2026-10-15 | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a th… |
CVE-2026-109694 | Critical | 9.8 | 2026-10-15 | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a th… |
CVE-2026-16438 | | | 2026-10-15 | Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Histo… |
CVE-2026-73814 | | | 2026-10-14 | Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can… |
CVE-2026-73804 | | | 2026-10-14 | Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresp… |
CVE-2026-60010 | Medium | 6.5 | 2026-10-14 | Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite R… |
CVE-2026-107424 | Critical | 9.8 | 2026-10-14 | Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend… |
CVE-2026-102851 | Medium | 6.1 | 2026-10-13 | Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. |
CVE-2026-105445 | | | 2026-10-13 | An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a pers… |
CVE-2026-109605 | High | 7.3 | 2026-10-13 | A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_clas… |
CVE-2026-65199 | Medium | 5.4 | 2026-10-13 | openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke map… |
CVE-2026-109520 | High | 8.8 | 2026-10-13 | A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of… |
CVE-2026-59241 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions… |
CVE-2026-109143 | Medium | 5.4 | 2026-10-13 | A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/cred… |
CVE-2026-104661 | Medium | 4.3 | 2026-10-13 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain cond… |
CVE-2026-108923 | Medium | 6.3 | 2026-10-12 | A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/que… |
CVE-2026-108899 | High | 7.3 | 2026-10-12 | A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component… |
CVE-2026-108890 | Medium | 6.3 | 2026-10-12 | A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file… |
CVE-2026-108835 | Medium | 4.4 | 2026-10-12 | A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14000885C in the library kgameprotect.sys. Executing a m… |
CVE-2026-108825 | Medium | 5.4 | 2026-10-12 | A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such mani… |
CVE-2026-108812 | Medium | 6.5 | 2026-10-12 | A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF… |
CVE-2026-108795 | Medium | 4.3 | 2026-10-12 | A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSett… |
CVE-2026-108575 | Medium | 6.3 | 2026-10-11 | A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secre… |
CVE-2026-62022 | Critical | 9.8 | 2026-10-10 | Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions. |
CVE-2026-39801 | Critical | 9.8 | 2026-10-10 | Subscriber Privilege Escalation in AIWU <= 1.5.9 versions. |
CVE-2026-96341 | High | 8.2 | 2026-10-10 | Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57… |
CVE-2026-106610 | Critical | 9.8 | 2026-10-10 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affec… |
CVE-2026-106608 | High | 7.2 | 2026-10-10 | Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 throu… |
CVE-2026-96539 | Medium | 5.6 | 2026-10-09 | Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member… |
CVE-2026-106145 | High | 7.1 | 2026-10-09 | In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user… |
CVE-2026-95594 | High | 8.1 | 2026-10-06 | Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This iss… |
CVE-2026-48197 | High | 7.2 | 2026-10-06 | Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affec… |
CVE-2026-39775 | High | 8.8 | 2026-10-06 | Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions. |
CVE-2026-39774 | High | 8.8 | 2026-10-06 | Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions. |
CVE-2026-39773 | Critical | 10.0 | 2026-10-06 | Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions. |
CVE-2026-39765 | High | 7.2 | 2026-10-06 | Shop Manager Privilege Escalation in Challan <= 3.7.88 versions. |
CVE-2026-39761 | Critical | 9.8 | 2026-10-06 | Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions. |
CVE-2026-39753 | Critical | 9.8 | 2026-10-06 | Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions. |
CVE-2026-105070 | High | 8.8 | 2026-10-06 | Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. |
CVE-2026-105058 | High | 8.8 | 2026-10-06 | Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. |
CVE-2026-104757 | High | 7.2 | 2026-10-06 | Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions. |
CVE-2026-104405 | High | 8.1 | 2026-10-06 | Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. |
CVE-2026-105621 | Medium | 5.4 | 2026-10-06 | A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/c… |
CVE-2026-105611 | Low | 2.7 | 2026-10-06 | A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/or… |
CVE-2026-105610 | Medium | 4.7 | 2026-10-06 | A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/j… |
CVE-2026-105571 | High | 7.3 | 2026-10-06 | A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the compon… |
CVE-2026-105382 | High | 7.3 | 2026-10-05 | A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount o… |
CVE-2026-105284 | Critical | 10.0 | 2026-10-05 | A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component… |
CVE-2026-103752 | Critical | 9.8 | 2026-10-01 | Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. |
CVE-2026-103068 | High | 8.8 | 2026-10-01 | Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions. |
CVE-2026-103286 | High | 7.3 | 2026-10-01 | Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to esca… |
CVE-2026-103494 | Medium | 6.6 | 2026-10-01 | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes |
CVE-2026-103534 | Medium | 6.3 | 2026-10-01 | A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/… |
CVE-2026-103532 | Medium | 5.3 | 2026-10-01 | A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the… |
CVE-2026-102129 | High | 7.2 | 2026-09-30 | A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrato… |
CVE-2026-103470 | | | 2026-09-30 | In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges. |
CVE-2026-97245 | High | 7.2 | 2026-09-30 | Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. |
CVE-2026-96821 | Medium | 6.3 | 2026-09-30 | Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. |
CVE-2026-96815 | High | 7.2 | 2026-09-30 | Custom role Privilege Escalation in Vitepos <= 3.5.0 versions. |
CVE-2026-96350 | Critical | 9.8 | 2026-09-30 | Subscriber Privilege Escalation in Estatik <= 4.3.5 versions. |
CVE-2026-94178 | High | 7.5 | 2026-09-30 | Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions. |
CVE-2026-102846 | Medium | 4.7 | 2026-09-30 | A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of t… |
CVE-2026-102674 | High | 8.2 | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, wi… |
CVE-2026-102293 | High | 7.3 | 2026-09-29 | A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the compo… |
CVE-2026-101860 | High | 8.8 | 2026-09-29 | A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugin… |
CVE-2026-101144 | Medium | 6.3 | 2026-09-28 | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Quer… |
CVE-2026-93540 | Medium | 6.5 | 2026-09-28 | A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options… |
CVE-2026-101054 | Medium | 5.3 | 2026-09-28 | A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_supplicant.conf of the component TCP Se… |
CVE-2026-101053 | High | 7.3 | 2026-09-28 | A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP S… |
CVE-2026-100883 | Medium | 6.3 | 2026-09-27 | A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Exec… |
CVE-2026-100619 | High | 8.8 | 2026-09-26 | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed… |
CVE-2026-97895 | Medium | 6.3 | 2026-09-25 | A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/… |
CVE-2026-97324 | High | 7.3 | 2026-09-24 | A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/s… |
CVE-2026-96882 | Medium | 5.3 | 2026-09-24 | A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/… |
CVE-2026-96881 | Medium | 5.3 | 2026-09-24 | A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/lattic… |
CVE-2026-96880 | Medium | 5.3 | 2026-09-24 | A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/con… |
CVE-2026-96763 | Medium | 5.4 | 2026-09-24 | A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegm… |
CVE-2026-86583 | High | 8.8 | 2026-09-23 | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugi… |
CVE-2026-96556 | High | 7.3 | 2026-09-23 | A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a mani… |
CVE-2026-84716 | Medium | 6.6 | 2026-09-23 | A flaw was found in the automation-controller instance
install-bundle endpoint. When a System Administrator downloads
an ex… |
CVE-2026-94425 | High | 8.8 | 2026-09-21 | A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub_140006F0C in the library mtdispkm64.sys of… |
CVE-2026-94048 | Medium | 6.6 | 2026-09-20 | A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.p… |
CVE-2026-94047 | Medium | 6.3 | 2026-09-20 | A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/temp… |
CVE-2026-94036 | High | 8.8 | 2026-09-20 | A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus… |
CVE-2026-93968 | Low | 3.8 | 2026-09-20 | A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSer… |
CVE-2026-93961 | Medium | 5.3 | 2026-09-20 | A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/u… |
CVE-2026-63349 | | | 2026-09-18 | AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_g… |
CVE-2026-93504 | Medium | 6.3 | 2026-09-18 | A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute… |
CVE-2026-73461 | High | 8.0 | 2026-09-16 | On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong priv… |
CVE-2026-91930 | High | 7.5 | 2026-09-15 | Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitr… |
CVE-2026-90856 | High | 7.3 | 2026-09-15 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.p… |
CVE-2026-90851 | Medium | 6.3 | 2026-09-15 | A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of… |
CVE-2026-90812 | Medium | 4.3 | 2026-09-14 | A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilit… |
CVE-2026-90810 | Medium | 6.3 | 2026-09-14 | A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of… |
CVE-2026-86830 | High | 7.2 | 2026-09-14 | Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenti… |
CVE-2026-90787 | High | 7.3 | 2026-09-14 | A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of… |
CVE-2026-78330 | Critical | 9.8 | 2026-09-14 | Incorrect privilege assignment vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least prot… |
CVE-2026-90566 | High | 7.3 | 2026-09-13 | A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the fu… |
CVE-2026-90565 | Medium | 5.3 | 2026-09-13 | A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of… |