CVE-2026-105171 | Medium | 6.3 | 2026-10-05 | A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79… |
CVE-2026-105097 | Medium | 4.3 | 2026-10-04 | A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer… |
CVE-2026-105096 | Medium | 6.3 | 2026-10-04 | A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile… |
CVE-2026-105121 | Medium | 4.9 | 2026-10-03 | OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because rea… |
CVE-2026-105119 | Medium | 6.8 | 2026-10-03 | OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through O… |
CVE-2026-71886 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key o… |
CVE-2026-104910 | | | 2026-10-02 | MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the sys… |
CVE-2026-104908 | | | 2026-10-02 | MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying… |
CVE-2026-103858 | | | 2026-10-01 | MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post… |
CVE-2026-103659 | | | 2026-10-01 | MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes t… |
CVE-2026-103532 | Medium | 5.3 | 2026-10-01 | A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the… |
CVE-2026-103233 | Medium | 6.3 | 2026-09-30 | A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unkno… |
CVE-2026-93547 | | | 2026-09-30 | A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace c… |
CVE-2026-13720 | Medium | 5.4 | 2026-09-30 | An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboar… |
CVE-2026-102846 | Medium | 4.7 | 2026-09-30 | A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of t… |
CVE-2026-102844 | Low | 2.7 | 2026-09-30 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail… |
CVE-2026-86105 | | | 2026-09-30 | An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other… |
CVE-2026-86101 | | | 2026-09-30 | An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access… |
CVE-2026-81569 | Medium | 4.3 | 2026-09-29 | An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target pro… |
CVE-2026-102293 | High | 7.3 | 2026-09-29 | A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the compo… |
CVE-2026-102261 | Medium | 5.4 | 2026-09-29 | A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of… |
CVE-2026-101006 | Medium | 4.3 | 2026-09-28 | A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the… |
CVE-2026-100897 | Medium | 5.5 | 2026-09-28 | A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of… |
CVE-2026-100885 | High | 7.3 | 2026-09-27 | A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInst… |
CVE-2026-100878 | Medium | 6.3 | 2026-09-27 | A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/j… |
CVE-2025-71426 | High | 7.1 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recove… |
CVE-2026-55217 | | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete… |
CVE-2026-53628 | | | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth… |
CVE-2026-61837 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topolog… |
CVE-2026-96448 | Medium | 6.6 | 2026-09-25 | A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the sys… |
CVE-2026-92799 | Medium | 5.3 | 2026-09-25 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions… |
CVE-2026-97721 | Low | 2.7 | 2026-09-25 | A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-p… |
CVE-2026-97647 | Medium | 5.3 | 2026-09-25 | A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown func… |
CVE-2026-97646 | High | 7.3 | 2026-09-25 | A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the… |
CVE-2026-97368 | Medium | 6.3 | 2026-09-24 | A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-syste… |
CVE-2026-97324 | High | 7.3 | 2026-09-24 | A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/s… |
CVE-2026-62286 | Medium | 4.3 | 2026-09-24 | Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to cont… |
CVE-2026-61604 | | | 2026-09-24 | The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that w… |
CVE-2026-96882 | Medium | 5.3 | 2026-09-24 | A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/… |
CVE-2026-96881 | Medium | 5.3 | 2026-09-24 | A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/lattic… |
CVE-2026-96880 | Medium | 5.3 | 2026-09-24 | A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/con… |
CVE-2026-96762 | High | 7.3 | 2026-09-24 | A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. Th… |
CVE-2026-96556 | High | 7.3 | 2026-09-23 | A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a mani… |
CVE-2026-16346 | Critical | 9.9 | 2026-09-22 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
CVE-2026-83805 | Medium | 6.4 | 2026-09-22 | Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does n… |
CVE-2026-95805 | | | 2026-09-22 | A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'them… |
CVE-2026-85055 | | | 2026-09-22 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields bu… |
CVE-2026-95754 | | | 2026-09-22 | In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification branch did not inclu… |
CVE-2026-95671 | | | 2026-09-22 | In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method… |
CVE-2026-25254 | Critical | 9.8 | 2026-09-22 | Improper authorization leads to Remote Code Execution via SocketIO interface. |
CVE-2026-79917 | Medium | 6.5 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a con… |
CVE-2026-63330 | High | 7.7 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.r… |
CVE-2026-94379 | | | 2026-09-21 | The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code us… |
CVE-2026-94152 | Medium | 4.3 | 2026-09-21 | A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the compone… |
CVE-2026-93961 | Medium | 5.3 | 2026-09-20 | A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/u… |
CVE-2026-93955 | Medium | 4.3 | 2026-09-19 | A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file back… |
CVE-2026-93954 | Medium | 4.3 | 2026-09-19 | A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the fi… |
CVE-2026-84241 | High | 8.1 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization. |
CVE-2026-84076 | High | 7.6 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization. |
CVE-2026-84036 | High | 7.4 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization. |
CVE-2026-77239 | High | 8.1 | 2026-09-18 | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do no… |
CVE-2026-61833 | High | 8.1 | 2026-09-18 | zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication ha… |
CVE-2026-10030 | High | 7.1 | 2026-09-18 | IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks. |
CVE-2026-67102 | High | 8.1 | 2026-09-18 | HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized… |
CVE-2026-85878 | Critical | 9.9 | 2026-09-18 | Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70200 | Critical | 10.0 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-54551 | Medium | 4.3 | 2026-09-17 | WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws s… |
CVE-2026-20286 | Medium | 4.3 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco Identify Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of… |
CVE-2026-20285 | Medium | 4.3 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an… |
CVE-2026-76420 | Critical | 9.0 | 2026-09-16 | A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, r… |
CVE-2026-92087 | High | 8.1 | 2026-09-16 | @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0… |
CVE-2026-83431 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-58704 | High | 8.8 | 2026-09-15 | In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privileg… |
CVE-2026-11934 | High | 7.2 | 2026-09-15 | IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied inp… |
CVE-2026-21587 | | | 2026-09-15 | This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center.
This Improper Authorizatio… |
CVE-2026-21586 | | | 2026-09-15 | This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0… |
CVE-2026-55775 | | | 2026-09-15 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-roo… |
CVE-2026-49446 | Medium | 6.1 | 2026-09-15 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tok… |
CVE-2026-52826 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{r… |
CVE-2026-52825 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} veri… |
CVE-2026-52822 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web dupli… |
CVE-2026-48717 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the rea… |
CVE-2026-45052 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote reques… |
CVE-2026-45048 | High | 8.5 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ow… |
CVE-2026-90858 | High | 7.3 | 2026-09-15 | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the fun… |
CVE-2026-86891 | Low | 3.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS… |
CVE-2026-84636 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may… |
CVE-2026-84621 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27… |
CVE-2026-84615 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, tvOS 27, visionOS 2… |
CVE-2026-84600 | Medium | 5.4 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, w… |
CVE-2026-84556 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app ma… |
CVE-2026-75792 | Medium | 4.3 | 2026-09-14 | IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-si… |
CVE-2026-65353 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An app may be able to a… |
CVE-2026-43695 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, mac… |
CVE-2026-90810 | Medium | 6.3 | 2026-09-14 | A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of… |
CVE-2026-54178 | High | 8.1 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-55236 | Medium | 5.9 | 2026-09-14 | langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant att… |
CVE-2026-90935 | Medium | 4.3 | 2026-09-14 | Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers c… |
CVE-2026-90697 | Medium | 4.3 | 2026-09-14 | A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the… |
CVE-2026-90598 | Medium | 6.3 | 2026-09-13 | A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function… |