CVE-2024-14046 | Medium | 6.3 | 2026-08-18 | A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/… |
CVE-2026-42163 | Critical | 9.8 | 2026-08-17 | Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstanc… |
CVE-2026-19992 | Low | 3.1 | 2026-08-17 | A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the… |
CVE-2026-73061 | Critical | 9.8 | 2026-08-16 | Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without s… |
CVE-2026-19711 | Medium | 6.5 | 2026-08-16 | The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any au… |
CVE-2026-19918 | Medium | 6.3 | 2026-08-16 | A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Inte… |
CVE-2026-14229 | Medium | 5.3 | 2026-08-15 | The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX… |
CVE-2026-71570 | | | 2026-08-14 | Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` on… |
CVE-2026-19839 | Medium | 4.7 | 2026-08-14 | A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. T… |
CVE-2026-19837 | Low | 2.7 | 2026-08-14 | A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search… |
CVE-2026-19835 | Low | 3.8 | 2026-08-14 | A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletio… |
CVE-2026-72837 | High | 8.8 | 2026-08-14 | File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid u… |
CVE-2026-73664 | | | 2026-08-13 | FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SS… |
CVE-2026-59763 | Medium | 4.3 | 2026-08-13 | Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads |
CVE-2026-58508 | Critical | 9.1 | 2026-08-13 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) |
CVE-2026-58507 | Medium | 5.3 | 2026-08-13 | Private Repository Existence Disclosure via go-get Meta Endpoint |
CVE-2026-58440 | Medium | 6.8 | 2026-08-13 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocati… |
CVE-2026-58439 | High | 8.1 | 2026-08-13 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag |
CVE-2026-58437 | High | 7.1 | 2026-08-13 | Repository Visibility Manipulation via Git Push Options |
CVE-2026-58429 | Medium | 4.9 | 2026-08-13 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints |
CVE-2026-58420 | Medium | 4.4 | 2026-08-13 | Local File Inclusion via file:// URI in Migration Restore |
CVE-2026-58417 | High | 7.5 | 2026-08-13 | REST API exposes organization membership of private organizations to public |
CVE-2026-56755 | Medium | 6.2 | 2026-08-13 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
CVE-2026-56750 | Critical | 9.1 | 2026-08-13 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session |
CVE-2026-56657 | Medium | 6.2 | 2026-08-13 | Gitea SSH Key Parser Denial of Service |
CVE-2026-56654 | Critical | 9.8 | 2026-08-13 | Privilege Escalation via Access Token Scope Escalation in API |
CVE-2026-55986 | Medium | 5.4 | 2026-08-13 | Email Management API Bypasses ManageCredentials Feature Restrictions |
CVE-2026-55984 | Low | 2.7 | 2026-08-13 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service |
CVE-2026-73626 | Unrated | | 2026-08-13 | JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the… |
CVE-2026-59505 | High | 8.6 | 2026-08-13 | CWE-284: Improper Access Control |
CVE-2026-59501 | High | 8.2 | 2026-08-13 | CWE-284: Improper Access Control |
CVE-2026-13328 | Medium | 5.3 | 2026-08-13 | The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed… |
CVE-2026-13367 | High | 7.8 | 2026-08-12 | IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility. |
CVE-2026-59917 | High | 7.8 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with l… |
CVE-2026-59914 | High | 7.8 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged at… |
CVE-2026-67287 | | | 2026-08-12 | Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances… |
CVE-2026-67284 | | | 2026-08-12 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-re… |
CVE-2026-67283 | | | 2026-08-12 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-… |
CVE-2026-16538 | Critical | 9.1 | 2026-08-12 | The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowi… |
CVE-2026-14859 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated user… |
CVE-2026-13171 | High | 8.2 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to… |
CVE-2026-73212 | | | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range()… |
CVE-2026-66804 | High | 7.8 | 2026-08-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-65773 | High | 7.8 | 2026-08-11 | Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-65675 | High | 7.1 | 2026-08-11 | No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-20898 | | | 2026-08-11 | Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalation of privilege. St… |
CVE-2026-20789 | | | 2026-08-11 | Improper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivi… |
CVE-2026-20741 | | | 2026-08-11 | Improper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adve… |
CVE-2026-20716 | | | 2026-08-11 | Improper access control for some Intel(R) Processors within Ring 3: User Applications may allow an escalation of privilege. Simple hardware adversary with an a… |
CVE-2026-72601 | High | 7.5 | 2026-08-11 | A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable i… |
CVE-2026-72600 | High | 7.5 | 2026-08-11 | A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer… |
CVE-2026-72596 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model… |
CVE-2026-72595 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams vi… |
CVE-2026-72563 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams v… |
CVE-2026-72561 | High | 8.8 | 2026-08-11 | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the p… |
CVE-2026-72555 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causin… |
CVE-2026-72554 | Medium | 6.5 | 2026-08-11 | A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging… |
CVE-2026-72693 | High | 7.8 | 2026-08-11 | `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/… |
CVE-2026-72909 | | | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpn… |
CVE-2026-18951 | High | 8.8 | 2026-08-10 | A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permiss… |
CVE-2026-13717 | High | 8.8 | 2026-08-10 | A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with… |
CVE-2026-15060 | Medium | 4.7 | 2026-08-10 | When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged use… |
CVE-2026-72575 | Critical | 9.1 | 2026-08-10 | An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup record… |
CVE-2026-21084 | | | 2026-08-10 | Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information. |
CVE-2026-21064 | | | 2026-08-10 | Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. |
CVE-2026-17540 | High | 8.8 | 2026-08-10 | The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber… |
CVE-2026-17023 | Medium | 4.8 | 2026-08-10 | The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar autho… |
CVE-2026-17016 | Low | 3.7 | 2026-08-10 | The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total… |
CVE-2026-17012 | Medium | 5.3 | 2026-08-10 | The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment m… |
CVE-2026-19383 | Medium | 4.7 | 2026-08-10 | A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/… |
CVE-2026-19359 | Medium | 4.7 | 2026-08-09 | A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component… |
CVE-2026-19358 | Medium | 6.3 | 2026-08-09 | A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes impro… |
CVE-2026-19357 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The mani… |
CVE-2026-19356 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The ma… |
CVE-2026-16948 | High | 8.1 | 2026-08-08 | The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on ad… |
CVE-2026-19245 | Low | 3.3 | 2026-08-07 | A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of… |
CVE-2026-19244 | Medium | 4.7 | 2026-08-07 | A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of t… |
CVE-2026-19210 | Medium | 6.3 | 2026-08-07 | A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_… |
CVE-2026-66494 | | | 2026-08-07 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious… |
CVE-2026-54213 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be
shut down when a specific endpoint (/internalRestart… |
CVE-2026-54208 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an
unauthenticated attacker to create or write into exist… |
CVE-2026-12261 | Medium | 5.3 | 2026-08-07 | A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package arch… |
CVE-2026-19195 | High | 7.8 | 2026-08-07 | A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Ke… |
CVE-2026-19193 | High | 7.8 | 2026-08-07 | A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Exec… |
CVE-2026-19192 | High | 7.8 | 2026-08-07 | A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCo… |
CVE-2026-65668 | High | 8.8 | 2026-08-07 | Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. |
CVE-2026-56161 | Critical | 9.6 | 2026-08-07 | Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. |
CVE-2026-67687 | High | 8.8 | 2026-08-06 | Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java… |
CVE-2026-19065 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file up… |
CVE-2025-14561 | Critical | 9.0 | 2026-08-06 | In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privil… |
CVE-2026-55979 | Medium | 5.2 | 2026-08-06 | An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to… |
CVE-2026-55978 | High | 8.4 | 2026-08-06 | An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communicatio… |
CVE-2026-14829 | High | 8.2 | 2026-08-06 | The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-m… |
CVE-2026-13703 | Medium | 5.4 | 2026-08-06 | The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in u… |
CVE-2026-18995 | Medium | 4.3 | 2026-08-06 | A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParse… |
CVE-2026-18993 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_too… |
CVE-2026-18974 | Medium | 5.3 | 2026-08-06 | A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execut… |
CVE-2026-18969 | High | 7.3 | 2026-08-06 | A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dis… |
CVE-2025-63822 | High | 8.1 | 2026-08-05 | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass a… |
CVE-2026-70612 | Medium | 5.4 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, req… |