CVE-2026-101879 | Medium | 6.5 | 2026-09-30 | OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents… |
CVE-2026-102397 | Medium | 6.5 | 2026-09-30 | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions. |
CVE-2026-102375 | Medium | 6.5 | 2026-09-30 | Subscriber Broken Access Control in Optimole <= 4.2.14 versions. |
CVE-2026-47604 | Medium | 5.5 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel… |
CVE-2026-47603 | Medium | 5.5 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel… |
CVE-2026-47580 | High | 7.3 | 2026-09-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful e… |
CVE-2026-47559 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonging to another user's… |
CVE-2026-47552 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorization check and modify… |
CVE-2026-47493 | High | 7.8 | 2026-09-30 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources for which i… |
CVE-2026-47492 | Medium | 5.5 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A succe… |
CVE-2026-100280 | Low | 3.1 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible |
CVE-2026-100271 | Low | 2.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects |
CVE-2026-100269 | Medium | 4.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed |
CVE-2026-100266 | High | 7.7 | 2026-09-30 | In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address |
CVE-2026-97285 | Medium | 5.4 | 2026-09-30 | Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. |
CVE-2026-97267 | Medium | 4.3 | 2026-09-30 | Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions. |
CVE-2026-97247 | Medium | 6.5 | 2026-09-30 | Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. |
CVE-2026-97243 | Medium | 5.4 | 2026-09-30 | Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. |
CVE-2026-97239 | Medium | 6.5 | 2026-09-30 | Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. |
CVE-2026-97197 | High | 7.5 | 2026-09-30 | Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions. |
CVE-2026-96834 | Medium | 6.5 | 2026-09-30 | Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. |
CVE-2026-96823 | High | 7.5 | 2026-09-30 | Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions. |
CVE-2026-96818 | High | 7.5 | 2026-09-30 | Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions. |
CVE-2026-96817 | High | 8.2 | 2026-09-30 | Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions. |
CVE-2026-96348 | High | 7.5 | 2026-09-30 | Unauthenticated Broken Access Control in Bookly <= 28.2 versions. |
CVE-2026-95587 | High | 7.5 | 2026-09-30 | Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions. |
CVE-2026-94499 | High | 7.1 | 2026-09-30 | Subscriber Broken Access Control in FormGent <= 1.12.2 versions. |
CVE-2026-94120 | High | 7.5 | 2026-09-30 | Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions. |
CVE-2026-94074 | Medium | 6.5 | 2026-09-30 | Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions. |
CVE-2026-96342 | | | 2026-09-30 | Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a thro… |
CVE-2026-103239 | | | 2026-09-30 | MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP reques… |
CVE-2026-94297 | Low | 2.7 | 2026-09-30 | The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before cr… |
CVE-2026-93580 | Medium | 5.3 | 2026-09-30 | The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and… |
CVE-2026-85576 | Medium | 4.3 | 2026-09-30 | The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving… |
CVE-2026-90441 | | | 2026-09-30 | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includin… |
CVE-2026-86136 | | | 2026-09-30 | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includin… |
CVE-2026-81841 | Medium | 5.3 | 2026-09-29 | Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused s… |
CVE-2026-102320 | Medium | 6.5 | 2026-09-29 | Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin p… |
CVE-2026-102310 | Medium | 6.5 | 2026-09-29 | Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web orig… |
CVE-2026-95371 | Medium | 5.4 | 2026-09-29 | Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leverag… |
CVE-2026-95342 | Medium | 4.3 | 2026-09-29 | Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium se… |
CVE-2026-95320 | Medium | 5.4 | 2026-09-29 | Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address… |
CVE-2026-95301 | High | 8.1 | 2026-09-29 | Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site i… |
CVE-2026-95300 | Medium | 4.8 | 2026-09-29 | Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restr… |
CVE-2026-95297 | Medium | 6.5 | 2026-09-29 | Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page… |
CVE-2026-95296 | Medium | 4.3 | 2026-09-29 | Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin… |
CVE-2026-95290 | Medium | 5.4 | 2026-09-29 | Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access… |
CVE-2026-95287 | Medium | 5.4 | 2026-09-29 | Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site i… |
CVE-2026-95285 | | | 2026-09-29 | Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to by… |
CVE-2026-95278 | | | 2026-09-29 | Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system a… |
CVE-2026-100240 | | | 2026-09-29 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by AC… |
CVE-2026-93332 | Medium | 5.4 | 2026-09-29 | Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create… |
CVE-2026-100289 | Medium | 5.0 | 2026-09-29 | Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generat… |
CVE-2026-100287 | Medium | 5.4 | 2026-09-29 | Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently del… |
CVE-2026-101267 | | | 2026-09-29 | A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information… |
CVE-2026-87748 | High | 8.8 | 2026-09-29 | Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse.
This issue affects Qorela DC: from 1.6.1-RC2… |
CVE-2026-8937 | Medium | 4.3 | 2026-09-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain co… |
CVE-2026-8067 | Medium | 6.5 | 2026-09-29 | An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot th… |
CVE-2026-4523 | Low | 3.7 | 2026-09-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain c… |
CVE-2026-92142 | | | 2026-09-29 | Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the r… |
CVE-2026-91085 | | | 2026-09-29 | Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactor… |
CVE-2026-91048 | | | 2026-09-29 | The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no match… |
CVE-2026-102249 | High | 7.3 | 2026-09-29 | A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of… |
CVE-2026-102365 | Medium | 6.5 | 2026-09-29 | mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers ca… |
CVE-2026-101139 | Low | 2.7 | 2026-09-28 | A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of… |
CVE-2026-49994 | Critical | 9.1 | 2026-09-28 | Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validati… |
CVE-2026-96538 | | | 2026-09-28 | WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_writ… |
CVE-2026-86335 | Medium | 6.3 | 2026-09-28 | Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images fr… |
CVE-2026-82377 | Critical | 9.9 | 2026-09-28 | Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the lega… |
CVE-2026-89300 | Medium | 5.3 | 2026-09-28 | The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbi… |
CVE-2026-101000 | Critical | 10.0 | 2026-09-28 | A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.jso… |
CVE-2026-96283 | Low | 3.3 | 2026-09-27 | By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, makin… |
CVE-2026-101063 | Medium | 5.3 | 2026-09-27 | Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated at… |
CVE-2026-100879 | Medium | 4.3 | 2026-09-27 | A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of t… |
CVE-2026-100873 | Medium | 4.3 | 2026-09-27 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown func… |
CVE-2026-101047 | Medium | 5.3 | 2026-09-27 | Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended rand… |
CVE-2026-97227 | Medium | 5.9 | 2026-09-27 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, rely… |
CVE-2026-96897 | Medium | 5.3 | 2026-09-27 | The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users… |
CVE-2026-96896 | High | 7.2 | 2026-09-27 | The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowi… |
CVE-2026-100855 | Medium | 6.5 | 2026-09-27 | AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticate… |
CVE-2026-100854 | Medium | 6.3 | 2026-09-27 | AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence… |
CVE-2026-100853 | Medium | 5.9 | 2026-09-27 | In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download m… |
CVE-2026-100744 | High | 7.3 | 2026-09-27 | A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of t… |
CVE-2026-78582 | Medium | 6.5 | 2026-09-26 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC… |
CVE-2026-100634 | Medium | 4.7 | 2026-09-26 | SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/ma… |
CVE-2026-100617 | High | 8.8 | 2026-09-26 | Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant c… |
CVE-2026-100608 | High | 8.3 | 2026-09-26 | Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cl… |
CVE-2026-100605 | High | 7.1 | 2026-09-26 | Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. At… |
CVE-2026-100602 | Medium | 6.5 | 2026-09-26 | ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the publi… |
CVE-2026-96532 | High | 7.5 | 2026-09-26 | The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form… |
CVE-2026-96525 | Low | 2.7 | 2026-09-26 | The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and del… |
CVE-2026-100596 | High | 8.8 | 2026-09-26 | OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Atta… |
CVE-2026-100593 | Medium | 5.4 | 2026-09-26 | OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group c… |
CVE-2026-100592 | Medium | 6.3 | 2026-09-26 | OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. A… |
CVE-2026-100591 | Medium | 6.3 | 2026-09-26 | OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non… |
CVE-2026-100587 | High | 8.8 | 2026-09-26 | OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can i… |
CVE-2026-100585 | High | 8.0 | 2026-09-26 | OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered throug… |
CVE-2026-100583 | Medium | 4.3 | 2026-09-26 | OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retri… |
CVE-2026-100582 | Medium | 6.5 | 2026-09-26 | OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channe… |
CVE-2026-100575 | High | 8.8 | 2026-09-26 | OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack a… |