CVE-2026-111388 | Medium | 5.4 | 2026-10-16 | Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including… |
CVE-2026-61610 | | | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch a… |
CVE-2026-9703 | High | 7.1 | 2026-10-15 | Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an… |
CVE-2026-95180 | Medium | 5.5 | 2026-10-15 | An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application… |
CVE-2026-106031 | Medium | 6.5 | 2026-10-15 | The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured p… |
CVE-2026-107795 | | | 2026-10-14 | Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user… |
CVE-2026-110696 | Medium | 5.3 | 2026-10-14 | A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is an unknown f… |
CVE-2026-103988 | Medium | 5.4 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php… |
CVE-2026-55387 | | | 2026-10-14 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlie… |
CVE-2026-55384 | | | 2026-10-14 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, Inv… |
CVE-2026-77371 | | | 2026-10-14 | Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py cr… |
CVE-2026-103929 | High | 7.8 | 2026-10-14 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untr… |
CVE-2026-78433 | | | 2026-10-14 | Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the rep… |
CVE-2026-71301 | Medium | 4.3 | 2026-10-14 | Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only… |
CVE-2026-68964 | Medium | 4.3 | 2026-10-14 | Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public ke… |
CVE-2026-68957 | Medium | 4.3 | 2026-10-14 | Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted… |
CVE-2026-67577 | Medium | 4.3 | 2026-10-14 | Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users… |
CVE-2026-66877 | High | 8.1 | 2026-10-14 | Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement… |
CVE-2026-66874 | Medium | 6.5 | 2026-10-14 | For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters… |
CVE-2026-66849 | Medium | 4.3 | 2026-10-14 | Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restrict… |
CVE-2026-59766 | Medium | 4.3 | 2026-10-14 | Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting u… |
CVE-2026-101301 | Medium | 5.3 | 2026-10-14 | The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allo… |
CVE-2026-87968 | Medium | 5.3 | 2026-10-14 | The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or… |
CVE-2026-87843 | Medium | 6.5 | 2026-10-14 | The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer re… |
CVE-2026-85000 | Medium | 5.3 | 2026-10-14 | The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credent… |
CVE-2026-110459 | High | 8.6 | 2026-10-14 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make u… |
CVE-2026-110456 | Medium | 5.3 | 2026-10-14 | A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key… |
CVE-2026-110454 | Medium | 5.3 | 2026-10-14 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources… |
CVE-2026-100115 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this… |
CVE-2026-100114 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this… |
CVE-2026-93895 | Critical | 9.1 | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on g… |
CVE-2026-105443 | High | 8.2 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. |
CVE-2026-70217 | Medium | 4.9 | 2026-10-13 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-102860 | High | 8.8 | 2026-10-13 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-110025 | High | 7.3 | 2026-10-13 | A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.i… |
CVE-2026-109526 | Low | 3.3 | 2026-10-13 | A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation l… |
CVE-2024-34320 | Critical | 9.8 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. |
CVE-2026-108975 | High | 7.3 | 2026-10-13 | A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file adm… |
CVE-2026-108974 | High | 7.3 | 2026-10-13 | A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipu… |
CVE-2026-108973 | High | 7.3 | 2026-10-13 | A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Use… |
CVE-2023-54412 | Medium | 6.5 | 2026-10-12 | Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non… |
CVE-2026-97691 | Medium | 4.3 | 2026-10-12 | Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary… |
CVE-2026-18517 | High | 7.7 | 2026-10-12 | IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vuln… |
CVE-2026-108930 | Low | 2.7 | 2026-10-12 | A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the c… |
CVE-2026-106495 | Medium | 4.3 | 2026-10-12 | Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control… |
CVE-2026-108923 | Medium | 6.3 | 2026-10-12 | A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/que… |
CVE-2026-18166 | High | 7.7 | 2026-10-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker… |
CVE-2026-108922 | Medium | 6.3 | 2026-10-12 | A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the f… |
CVE-2026-108811 | Medium | 4.3 | 2026-10-12 | A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/… |
CVE-2026-108810 | Medium | 5.3 | 2026-10-12 | A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The ma… |
CVE-2026-108801 | Medium | 6.3 | 2026-10-12 | A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanag… |
CVE-2026-108795 | Medium | 4.3 | 2026-10-12 | A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSett… |
CVE-2026-108578 | Medium | 5.3 | 2026-10-11 | A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such m… |
CVE-2026-19574 | High | 7.0 | 2026-10-09 | The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/cor… |
CVE-2026-92989 | Medium | 4.3 | 2026-10-09 | The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authen… |
CVE-2026-107510 | Critical | 9.1 | 2026-10-08 | An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation. |
CVE-2026-76281 | Medium | 5.3 | 2026-10-07 | Improper Access Control. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The… |
CVE-2026-76265 | Medium | 6.5 | 2026-10-07 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does… |
CVE-2026-76498 | Critical | 9.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team… |
CVE-2026-76463 | High | 8.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal s… |
CVE-2026-76455 | Critical | 9.8 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal securi… |
CVE-2026-20038 | Medium | 5.8 | 2026-10-07 | A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remot… |
CVE-2026-106580 | Medium | 4.0 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check… |
CVE-2026-107175 | | | 2026-10-07 | MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sh… |
CVE-2026-102781 | | | 2026-10-07 | Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s… |
CVE-2026-104678 | Low | 2.7 | 2026-10-07 | The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level… |
CVE-2026-103681 | Medium | 4.3 | 2026-10-07 | The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low priv… |
CVE-2026-97680 | High | 8.3 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper acce… |
CVE-2026-101329 | Medium | 6.5 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control. |
CVE-2026-104335 | High | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control. |
CVE-2026-106503 | High | 8.1 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affe… |
CVE-2026-79797 | High | 8.8 | 2026-10-06 | An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality… |
CVE-2026-86362 | High | 8.2 | 2026-10-06 | Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially… |
CVE-2026-106513 | | | 2026-10-06 | MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJo… |
CVE-2026-105855 | High | 7.1 | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to… |
CVE-2026-105851 | High | 8.1 | 2026-10-06 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the dupl… |
CVE-2026-94278 | Medium | 5.5 | 2026-10-06 | The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any use… |
CVE-2026-95263 | High | 7.2 | 2026-10-05 | Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password o… |
CVE-2026-105692 | Medium | 5.4 | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies onl… |
CVE-2026-105389 | Medium | 6.3 | 2026-10-05 | A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/… |
CVE-2026-105635 | High | 7.4 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permis… |
CVE-2026-103085 | Medium | 6.5 | 2026-10-05 | Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a th… |
CVE-2026-105632 | | | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in th… |
CVE-2026-104974 | High | 8.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with exi… |
CVE-2026-13607 | Medium | 5.9 | 2026-10-05 | The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the acc… |
CVE-2026-105145 | Medium | 5.3 | 2026-10-04 | A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file goldenverba/components… |
CVE-2026-97332 | Medium | 5.3 | 2026-10-04 | The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it… |
CVE-2026-105098 | Medium | 4.3 | 2026-10-04 | A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support… |
CVE-2026-102795 | Critical | 9.3 | 2026-10-02 | Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10… |
CVE-2026-51916 | High | 7.5 | 2026-10-02 | TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affec… |
CVE-2026-51915 | Critical | 9.8 | 2026-10-02 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in… |
CVE-2026-51914 | High | 8.8 | 2026-10-02 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_tem… |
CVE-2026-51904 | Critical | 9.8 | 2026-10-02 | SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_executio… |
CVE-2026-51901 | High | 8.1 | 2026-10-02 | SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated use… |
CVE-2026-51899 | Medium | 4.3 | 2026-10-02 | In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_… |
CVE-2026-104914 | | | 2026-10-02 | MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
When a user queries for soft-deleted at… |
CVE-2026-104912 | | | 2026-10-02 | MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation l… |
CVE-2026-104637 | High | 7.3 | 2026-10-02 | A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function… |
CVE-2026-13413 | Medium | 5.3 | 2026-10-02 | The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled… |
CVE-2026-85004 | Medium | 4.3 | 2026-10-02 | The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing… |