CVE-2026-54683 | Medium | 6.5 | 2026-10-15 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-61838 | | | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and… |
CVE-2026-55383 | High | 8.2 | 2026-10-14 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, Inv… |
CVE-2026-70407 | Medium | 4.3 | 2026-10-14 | Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organiza… |
CVE-2026-70218 | High | 7.8 | 2026-10-13 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2026-109605 | High | 7.3 | 2026-10-13 | A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_clas… |
CVE-2026-109962 | Medium | 4.3 | 2026-10-13 | Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob conf… |
CVE-2026-109116 | High | 7.3 | 2026-10-13 | A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_q… |
CVE-2026-17475 | High | 7.1 | 2026-10-12 | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper fun… |
CVE-2023-54410 | Medium | 4.3 | 2026-10-12 | Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission c… |
CVE-2026-84314 | | | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to ch… |
CVE-2026-108924 | Medium | 4.3 | 2026-10-12 | A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/Options… |
CVE-2026-108899 | High | 7.3 | 2026-10-12 | A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component… |
CVE-2026-108890 | Medium | 6.3 | 2026-10-12 | A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file… |
CVE-2026-108812 | Medium | 6.5 | 2026-10-12 | A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF… |
CVE-2026-108797 | Medium | 4.3 | 2026-10-12 | A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of th… |
CVE-2026-108796 | Medium | 4.3 | 2026-10-12 | A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Dat… |
CVE-2026-108575 | Medium | 6.3 | 2026-10-11 | A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secre… |
CVE-2026-108574 | Medium | 4.3 | 2026-10-11 | A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracki… |
CVE-2026-11930 | Medium | 5.9 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web server… |
CVE-2026-16181 | High | 7.4 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacke… |
CVE-2026-76275 | Medium | 4.3 | 2026-10-07 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query… |
CVE-2026-104632 | High | 8.8 | 2026-10-06 | Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required… |
CVE-2026-105703 | Medium | 4.7 | 2026-10-06 | A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file… |
CVE-2026-105621 | Medium | 5.4 | 2026-10-06 | A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/c… |
CVE-2026-105611 | Low | 2.7 | 2026-10-06 | A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/or… |
CVE-2026-105610 | Medium | 4.7 | 2026-10-06 | A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/j… |
CVE-2026-105572 | Medium | 4.3 | 2026-10-06 | A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoi… |
CVE-2026-105571 | High | 7.3 | 2026-10-06 | A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the compon… |
CVE-2026-105382 | High | 7.3 | 2026-10-05 | A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount o… |
CVE-2026-104955 | Medium | 5.4 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint a… |
CVE-2026-105284 | Critical | 10.0 | 2026-10-05 | A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component… |
CVE-2026-105171 | Medium | 6.3 | 2026-10-05 | A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79… |
CVE-2026-105097 | Medium | 4.3 | 2026-10-04 | A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer… |
CVE-2026-105096 | Medium | 6.3 | 2026-10-04 | A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile… |
CVE-2026-105121 | Medium | 4.9 | 2026-10-03 | OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because rea… |
CVE-2026-105119 | Medium | 6.8 | 2026-10-03 | OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through O… |
CVE-2026-71886 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key o… |
CVE-2026-104910 | | | 2026-10-02 | MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the sys… |
CVE-2026-104908 | | | 2026-10-02 | MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying… |
CVE-2026-51876 | Critical | 9.1 | 2026-10-01 | DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly ex… |
CVE-2026-103858 | | | 2026-10-01 | MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post… |
CVE-2026-103659 | | | 2026-10-01 | MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes t… |
CVE-2026-103532 | Medium | 5.3 | 2026-10-01 | A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the… |
CVE-2026-103233 | Medium | 6.3 | 2026-09-30 | A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unkno… |
CVE-2026-93547 | | | 2026-09-30 | A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace c… |
CVE-2026-13720 | Medium | 5.4 | 2026-09-30 | An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboar… |
CVE-2026-102846 | Medium | 4.7 | 2026-09-30 | A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of t… |
CVE-2026-102844 | Low | 2.7 | 2026-09-30 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail… |
CVE-2026-86105 | High | 7.1 | 2026-09-30 | An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other… |
CVE-2026-86101 | Medium | 6.5 | 2026-09-30 | An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access… |
CVE-2026-81569 | Medium | 4.3 | 2026-09-29 | An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target pro… |
CVE-2026-102293 | High | 7.3 | 2026-09-29 | A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the compo… |
CVE-2026-102261 | Medium | 5.4 | 2026-09-29 | A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of… |
CVE-2026-101006 | Medium | 4.3 | 2026-09-28 | A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the… |
CVE-2026-100897 | Medium | 5.5 | 2026-09-28 | A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of… |
CVE-2026-100885 | High | 7.3 | 2026-09-27 | A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInst… |
CVE-2026-100878 | Medium | 6.3 | 2026-09-27 | A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/j… |
CVE-2025-71426 | High | 7.1 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recove… |
CVE-2026-55217 | | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete… |
CVE-2026-53628 | | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth… |
CVE-2026-61837 | Medium | 5.3 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topolog… |
CVE-2026-96448 | Medium | 6.6 | 2026-09-25 | A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the sys… |
CVE-2026-92799 | Medium | 5.3 | 2026-09-25 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions… |
CVE-2026-97721 | Low | 2.7 | 2026-09-25 | A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-p… |
CVE-2026-97647 | Medium | 5.3 | 2026-09-25 | A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown func… |
CVE-2026-97646 | High | 7.3 | 2026-09-25 | A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the… |
CVE-2026-97368 | Medium | 6.3 | 2026-09-24 | A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-syste… |
CVE-2026-97324 | High | 7.3 | 2026-09-24 | A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/s… |
CVE-2026-62286 | Medium | 4.3 | 2026-09-24 | Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to cont… |
CVE-2026-61604 | | | 2026-09-24 | The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that w… |
CVE-2026-96882 | Medium | 5.3 | 2026-09-24 | A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/… |
CVE-2026-96881 | Medium | 5.3 | 2026-09-24 | A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/lattic… |
CVE-2026-96880 | Medium | 5.3 | 2026-09-24 | A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/con… |
CVE-2026-96762 | High | 7.3 | 2026-09-24 | A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. Th… |
CVE-2026-96556 | High | 7.3 | 2026-09-23 | A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a mani… |
CVE-2026-16346 | Critical | 9.9 | 2026-09-22 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
CVE-2026-83805 | Medium | 6.4 | 2026-09-22 | Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does n… |
CVE-2026-95805 | | | 2026-09-22 | A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'them… |
CVE-2026-85055 | | | 2026-09-22 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields bu… |
CVE-2026-95754 | | | 2026-09-22 | In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification branch did not inclu… |
CVE-2026-95671 | | | 2026-09-22 | In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method… |
CVE-2026-25254 | Critical | 9.8 | 2026-09-22 | Improper authorization leads to Remote Code Execution via SocketIO interface. |
CVE-2026-79917 | Medium | 6.5 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a con… |
CVE-2026-63330 | High | 7.7 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.r… |
CVE-2026-94379 | | | 2026-09-21 | The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code us… |
CVE-2026-94152 | Medium | 4.3 | 2026-09-21 | A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the compone… |
CVE-2026-93961 | Medium | 5.3 | 2026-09-20 | A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/u… |
CVE-2026-93955 | Medium | 4.3 | 2026-09-19 | A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file back… |
CVE-2026-93954 | Medium | 4.3 | 2026-09-19 | A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the fi… |
CVE-2026-84241 | High | 8.1 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization. |
CVE-2026-84076 | High | 7.6 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization. |
CVE-2026-84036 | High | 7.4 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization. |
CVE-2026-77239 | High | 8.1 | 2026-09-18 | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do no… |
CVE-2026-61833 | High | 8.1 | 2026-09-18 | zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication ha… |
CVE-2026-10030 | High | 7.1 | 2026-09-18 | IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks. |
CVE-2026-67102 | High | 8.1 | 2026-09-18 | HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized… |
CVE-2026-85878 | Critical | 9.9 | 2026-09-18 | Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70200 | Critical | 10.0 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-54551 | Medium | 4.3 | 2026-09-17 | WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws s… |