CVE-2026-100306 | Medium | 5.3 | 2026-09-25 | TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated atta… |
CVE-2026-77320 | Medium | 5.3 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and place… |
CVE-2026-82189 | | | 2026-09-15 | Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-serv… |
CVE-2026-54047 | | | 2026-09-11 | Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication… |
CVE-2026-89175 | Medium | 5.3 | 2026-09-11 | Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can… |
CVE-2026-77999 | | | 2026-09-03 | Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4… |
CVE-2026-84841 | High | 7.3 | 2026-09-02 | A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enfo… |
CVE-2026-77793 | Medium | 5.3 | 2026-09-02 | The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to c… |
CVE-2026-84110 | Medium | 5.3 | 2026-09-01 | A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulat… |
CVE-2026-73267 | High | 7.7 | 2026-08-21 | A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim r… |
CVE-2026-77026 | | | 2026-08-20 | Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access c… |
CVE-2026-45274 | | | 2026-08-19 | MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handler… |
CVE-2026-67363 | | | 2026-08-19 | Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge… |
CVE-2026-73627 | | | 2026-08-13 | JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enfor… |
CVE-2026-59504 | Critical | 9.1 | 2026-08-13 | : Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).
This issue a… |
CVE-2026-16480 | Medium | 4.3 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileg… |
CVE-2026-65938 | Medium | 4.3 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke… |
CVE-2026-72867 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/s… |
CVE-2026-14831 | Medium | 5.3 | 2026-08-06 | The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to c… |
CVE-2026-17985 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (… |
CVE-2026-17974 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a crafted HT… |
CVE-2026-17960 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass no-referrer policy via a c… |
CVE-2026-17953 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2026-17821 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-17813 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions vi… |
CVE-2026-17805 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a cr… |
CVE-2026-17756 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2026-17703 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions vi… |
CVE-2026-63301 | | | 2026-07-28 | In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, th… |
CVE-2026-64813 | Critical | 10.0 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session |
CVE-2026-65051 | Medium | 6.5 | 2026-07-21 | Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to b… |
CVE-2026-13724 | Medium | 4.3 | 2026-07-20 | Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Man… |
CVE-2026-46485 | High | 8.2 | 2026-07-15 | Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to w… |
CVE-2026-15130 | Medium | 4.3 | 2026-07-08 | Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML pa… |
CVE-2026-14109 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-14086 | High | 8.8 | 2026-06-30 | Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Ch… |
CVE-2026-14081 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-14075 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass no-referrer policy via a c… |
CVE-2026-14054 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2026-14047 | Medium | 4.3 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-14041 | High | 8.8 | 2026-06-30 | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
CVE-2026-14036 | High | 8.8 | 2026-06-30 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HT… |
CVE-2026-14033 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to bypass site isolation via a crafted HT… |
CVE-2026-14007 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2026-13930 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Actor in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-13919 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2026-13903 | High | 8.8 | 2026-06-30 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HT… |
CVE-2026-13901 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti… |
CVE-2026-13896 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-13894 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass navigation re… |
CVE-2026-13871 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2026-13795 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions vi… |
CVE-2025-36327 | Medium | 6.5 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to… |
CVE-2026-57913 | High | 7.5 | 2026-06-26 | Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts. |
CVE-2026-57912 | High | 7.5 | 2026-06-26 | Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers. |
CVE-2026-56256 | High | 7.1 | 2026-06-24 | Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing o… |
CVE-2026-56693 | Medium | 5.5 | 2026-06-23 | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writ… |
CVE-2026-54104 | High | 8.8 | 2026-06-18 | The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing S… |
CVE-2026-11287 | Medium | 6.5 | 2026-06-05 | Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-11267 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-11236 | High | 8.3 | 2026-06-04 | Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-11184 | Medium | 6.3 | 2026-06-04 | Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-11092 | High | 8.8 | 2026-06-04 | Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-11062 | Medium | 4.3 | 2026-06-04 | Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-11025 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy vi… |
CVE-2026-11018 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-11014 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-11011 | High | 8.1 | 2026-06-04 | Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-42329 | Medium | 4.7 | 2026-06-04 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 contain a weakness… |
CVE-2026-44567 | High | 7.3 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that th… |
CVE-2026-42266 | High | 8.8 | 2026-05-13 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-… |
CVE-2026-42160 | | | 2026-05-08 | Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3… |
CVE-2026-5901 | Medium | 6.5 | 2026-04-08 | Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-39415 | Medium | 4.3 | 2026-04-08 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in… |
CVE-2026-30522 | Medium | 6.5 | 2026-04-01 | A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrato… |
CVE-2026-30521 | Medium | 6.5 | 2026-03-31 | A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrato… |
CVE-2026-3941 | Medium | 4.3 | 2026-03-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-30933 | High | 7.5 | 2026-03-10 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Pas… |
CVE-2026-25737 | High | 8.9 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists… |
CVE-2026-29077 | High | 7.1 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could shar… |
CVE-2026-30783 | Critical | 9.8 | 2026-03-05 | A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config m… |
CVE-2026-23859 | Low | 2.7 | 2026-02-24 | Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with… |
CVE-2025-36410 | Low | 3.1 | 2026-01-20 | IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side s… |
CVE-2026-0808 | Medium | 5.3 | 2026-01-17 | The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trus… |
CVE-2026-23478 | Critical | 9.8 | 2026-01-13 | Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gai… |
CVE-2025-14687 | Medium | 4.3 | 2025-12-26 | IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side… |
CVE-2025-66507 | High | 7.5 | 2025-12-09 | 1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA v… |
CVE-2025-36102 | Low | 2.7 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input… |
CVE-2025-51682 | Critical | 9.8 | 2025-12-01 | mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. A… |
CVE-2025-7820 | High | 7.5 | 2025-11-27 | The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only e… |
CVE-2025-10161 | High | 7.3 | 2025-11-11 | Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision… |
CVE-2025-12788 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment byp… |
CVE-2025-36093 | Medium | 4.8 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using m… |
CVE-2025-12115 | High | 7.5 | 2025-10-31 | The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This i… |
CVE-2025-41402 | Medium | 5.5 | 2025-10-23 | Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing… |
CVE-2025-10640 | Critical | 9.8 | 2025-10-21 | An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login… |
CVE-2025-2139 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users du… |
CVE-2025-2138 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1
could allow an authenticated user on the network to delete comments from other users… |
CVE-2025-61197 | High | 8.9 | 2025-10-06 | An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 allows a remote att… |
CVE-2025-9495 | | | 2025-09-23 | The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker… |