CVE-2026-76498 | Critical | 9.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team… |
CVE-2026-76463 | High | 8.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal s… |
CVE-2026-76455 | Critical | 9.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal securi… |
CVE-2026-20038 | Medium | 5.8 | 2026-10-07 | A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remot… |
CVE-2026-106580 | Medium | 4.0 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check… |
CVE-2026-107175 | | | 2026-10-07 | MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sh… |
CVE-2026-102781 | | | 2026-10-07 | Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s… |
CVE-2026-104678 | Low | 2.7 | 2026-10-07 | The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level… |
CVE-2026-103681 | Medium | 4.3 | 2026-10-07 | The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low priv… |
CVE-2026-97680 | High | 8.3 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper acce… |
CVE-2026-101329 | Medium | 6.5 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control. |
CVE-2026-104335 | High | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control. |
CVE-2026-106503 | High | 8.1 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affe… |
CVE-2026-79797 | High | 8.8 | 2026-10-06 | An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality… |
CVE-2026-86362 | High | 8.2 | 2026-10-06 | Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially… |
CVE-2026-106513 | | | 2026-10-06 | MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJo… |
CVE-2026-105855 | | | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to… |
CVE-2026-105851 | | | 2026-10-06 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the dupl… |
CVE-2026-94278 | Medium | 5.5 | 2026-10-06 | The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any use… |
CVE-2026-95263 | High | 7.2 | 2026-10-05 | Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password o… |
CVE-2026-105692 | Medium | 5.4 | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies onl… |
CVE-2026-105389 | Medium | 6.3 | 2026-10-05 | A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/… |
CVE-2026-105635 | High | 7.4 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permis… |
CVE-2026-103085 | Medium | 6.5 | 2026-10-05 | Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a th… |
CVE-2026-105632 | | | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in th… |
CVE-2026-104974 | High | 8.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with exi… |
CVE-2026-13607 | Medium | 5.9 | 2026-10-05 | The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the acc… |
CVE-2026-105145 | Medium | 5.3 | 2026-10-04 | A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file goldenverba/components… |
CVE-2026-97332 | Medium | 5.3 | 2026-10-04 | The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it… |
CVE-2026-105098 | Medium | 4.3 | 2026-10-04 | A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support… |
CVE-2026-102795 | Critical | 9.3 | 2026-10-02 | Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10… |
CVE-2026-51916 | High | 7.5 | 2026-10-02 | TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affec… |
CVE-2026-51915 | Critical | 9.8 | 2026-10-02 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in… |
CVE-2026-51914 | High | 8.8 | 2026-10-02 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_tem… |
CVE-2026-51904 | Critical | 9.8 | 2026-10-02 | SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_executio… |
CVE-2026-51901 | High | 8.1 | 2026-10-02 | SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated use… |
CVE-2026-51899 | Medium | 4.3 | 2026-10-02 | In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_… |
CVE-2026-104914 | | | 2026-10-02 | MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
When a user queries for soft-deleted at… |
CVE-2026-104912 | | | 2026-10-02 | MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation l… |
CVE-2026-104637 | High | 7.3 | 2026-10-02 | A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function… |
CVE-2026-13413 | Medium | 5.3 | 2026-10-02 | The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled… |
CVE-2026-85004 | Medium | 4.3 | 2026-10-02 | The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing… |
CVE-2026-51897 | Critical | 9.8 | 2026-10-01 | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-cont… |
CVE-2026-51896 | Medium | 6.5 | 2026-10-01 | infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unaut… |
CVE-2026-51895 | Medium | 6.5 | 2026-10-01 | Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perf… |
CVE-2026-51894 | Medium | 6.5 | 2026-10-01 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and… |
CVE-2026-51893 | Critical | 9.8 | 2026-10-01 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant… |
CVE-2026-51892 | Medium | 6.5 | 2026-10-01 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>. |
CVE-2026-51878 | Medium | 4.3 | 2026-10-01 | deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. A remote caller can en… |
CVE-2026-63045 | High | 7.5 | 2026-10-01 | Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forw… |
CVE-2026-90972 | Medium | 5.4 | 2026-10-01 | The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber… |
CVE-2026-103541 | Medium | 6.3 | 2026-10-01 | A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of… |
CVE-2026-76142 | | | 2026-10-01 | Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker t… |
CVE-2026-103534 | Medium | 6.3 | 2026-10-01 | A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/… |
CVE-2026-51869 | Critical | 9.8 | 2026-09-30 | DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host. |
CVE-2026-51867 | Critical | 9.8 | 2026-09-30 | agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selecte… |
CVE-2026-102132 | High | 7.2 | 2026-09-30 | An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credenti… |
CVE-2026-55494 | Critical | 9.8 | 2026-09-30 | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker ma… |
CVE-2026-55181 | Critical | 9.4 | 2026-09-30 | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated eve… |
CVE-2026-103239 | | | 2026-09-30 | MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP reques… |
CVE-2026-89190 | Medium | 4.3 | 2026-09-30 | The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request… |
CVE-2026-88797 | High | 7.1 | 2026-09-30 | The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in u… |
CVE-2026-75824 | Medium | 5.3 | 2026-09-30 | The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated… |
CVE-2026-102845 | Medium | 5.3 | 2026-09-30 | A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function er… |
CVE-2026-102842 | Medium | 6.3 | 2026-09-30 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_use… |
CVE-2026-79417 | Medium | 5.3 | 2026-09-29 | Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle acces… |
CVE-2026-92226 | Medium | 6.0 | 2026-09-29 | Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows un… |
CVE-2026-92223 | Low | 3.8 | 2026-09-29 | Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthor… |
CVE-2026-90917 | Medium | 5.3 | 2026-09-29 | Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unautho… |
CVE-2026-90916 | Low | 2.7 | 2026-09-29 | Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows… |
CVE-2026-90913 | Medium | 5.5 | 2026-09-29 | Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allo… |
CVE-2026-92370 | High | 8.8 | 2026-09-29 | An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated rem… |
CVE-2026-100758 | Critical | 9.6 | 2026-09-29 | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Fir… |
CVE-2026-102263 | Medium | 4.7 | 2026-09-29 | A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file… |
CVE-2026-101146 | Medium | 4.3 | 2026-09-28 | A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom… |
CVE-2026-101144 | Medium | 6.3 | 2026-09-28 | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Quer… |
CVE-2026-101143 | Medium | 4.3 | 2026-09-28 | A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scor… |
CVE-2026-101891 | | | 2026-09-28 | An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the A… |
CVE-2026-101083 | Medium | 5.3 | 2026-09-28 | A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library encryptionhelper.dll. Such manipulation l… |
CVE-2026-101071 | Medium | 6.3 | 2026-09-28 | A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/uplo… |
CVE-2026-12265 | High | 8.8 | 2026-09-28 | Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL… |
CVE-2026-101055 | Medium | 5.3 | 2026-09-28 | A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. T… |
CVE-2026-101054 | Medium | 5.3 | 2026-09-28 | A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_supplicant.conf of the component TCP Se… |
CVE-2026-101053 | High | 7.3 | 2026-09-28 | A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP S… |
CVE-2026-100907 | Medium | 5.3 | 2026-09-28 | A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulat… |
CVE-2026-100906 | Medium | 5.3 | 2026-09-28 | A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipu… |
CVE-2026-100883 | Medium | 6.3 | 2026-09-27 | A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Exec… |
CVE-2026-96281 | Medium | 6.2 | 2026-09-27 | On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote re… |
CVE-2026-97163 | | | 2026-09-26 | Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
CVE-2026-97161 | | | 2026-09-26 | Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
CVE-2026-100621 | Medium | 4.3 | 2026-09-26 | Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication… |
CVE-2026-57449 | | | 2026-09-25 | Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only fro… |
CVE-2026-56729 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user wi… |
CVE-2026-88421 | High | 7.5 | 2026-09-25 | Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog e… |
CVE-2026-86859 | | | 2026-09-24 | ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could en… |
CVE-2026-86858 | | | 2026-09-24 | ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unau… |
CVE-2026-77321 | Medium | 4.3 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens wi… |
CVE-2026-77320 | Medium | 5.3 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and place… |
CVE-2026-85057 | High | 8.7 | 2026-09-24 | ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() regis… |
CVE-2026-79758 | Medium | 5.4 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix user… |