CVE-2026-8840 | Medium | 5.3 | 2026-08-15 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This… |
CVE-2026-16772 | High | 8.1 | 2026-08-14 | In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administ… |
CVE-2026-73048 | Medium | 5.8 | 2026-08-14 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing… |
CVE-2026-72825 | High | 7.6 | 2026-08-14 | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController)… |
CVE-2026-72824 | Critical | 9.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check… |
CVE-2026-72823 | Medium | 5.4 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks is… |
CVE-2026-72812 | Medium | 6.5 | 2026-08-14 | SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger p… |
CVE-2026-72810 | High | 8.6 | 2026-08-14 | SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfilter… |
CVE-2026-19786 | Medium | 4.3 | 2026-08-14 | A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulati… |
CVE-2026-73843 | Critical | 9.6 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing mana… |
CVE-2026-73842 | Critical | 9.0 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api… |
CVE-2026-73665 | | | 2026-08-13 | FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO versi… |
CVE-2026-73658 | High | 8.2 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4Fet… |
CVE-2026-73305 | High | 8.8 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.ap… |
CVE-2026-73656 | Critical | 9.9 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-w… |
CVE-2026-72681 | Medium | 6.5 | 2026-08-13 | Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a… |
CVE-2026-72675 | High | 7.1 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Ki… |
CVE-2026-72671 | Medium | 4.3 | 2026-08-13 | A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies on… |
CVE-2026-72669 | High | 7.6 | 2026-08-13 | The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state… |
CVE-2026-72665 | High | 8.1 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Func… |
CVE-2026-72664 | Medium | 6.5 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality No… |
CVE-2026-72661 | Medium | 6.5 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An interna… |
CVE-2026-59714 | High | 7.1 | 2026-08-13 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the conten… |
CVE-2026-73653 | Critical | 9.4 | 2026-08-13 | Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreensh… |
CVE-2026-58438 | High | 7.5 | 2026-08-13 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access |
CVE-2026-58434 | High | 7.5 | 2026-08-13 | Private Repository Metadata Remains Accessible After Access Revocation |
CVE-2026-58433 | Critical | 9.1 | 2026-08-13 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting |
CVE-2026-58432 | Medium | 5.9 | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive… |
CVE-2026-57886 | Medium | 5.9 | 2026-08-13 | Cross-repository issue/comment attachment re-linking can expose private attachment content |
CVE-2026-50105 | Medium | 4.3 | 2026-08-13 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |
CVE-2026-73403 | Medium | 5.3 | 2026-08-13 | Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. |
CVE-2026-73401 | Medium | 5.3 | 2026-08-13 | Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions. |
CVE-2026-73353 | Medium | 5.3 | 2026-08-13 | Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions. |
CVE-2026-73349 | Medium | 5.3 | 2026-08-13 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. |
CVE-2026-66693 | Medium | 6.5 | 2026-08-13 | Subscriber Broken Access Control in Motors <= 1.4.113 versions. |
CVE-2026-66689 | Medium | 6.3 | 2026-08-13 | Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions. |
CVE-2026-66660 | Medium | 6.5 | 2026-08-13 | Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions. |
CVE-2026-66469 | High | 7.5 | 2026-08-13 | Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. |
CVE-2026-66466 | High | 7.5 | 2026-08-13 | Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 vers… |
CVE-2026-66464 | Medium | 6.5 | 2026-08-13 | Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions. |
CVE-2026-66461 | High | 7.5 | 2026-08-13 | Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions. |
CVE-2026-66459 | Medium | 6.5 | 2026-08-13 | Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions. |
CVE-2026-66455 | Medium | 6.0 | 2026-08-13 | Subscriber Broken Access Control in ReactPress <= 3.4.0 versions. |
CVE-2026-66454 | Medium | 6.5 | 2026-08-13 | Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions. |
CVE-2026-66441 | High | 7.5 | 2026-08-13 | Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions. |
CVE-2026-66431 | High | 7.5 | 2026-08-13 | Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions. |
CVE-2026-61984 | High | 7.5 | 2026-08-13 | Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. |
CVE-2026-61978 | Medium | 6.5 | 2026-08-13 | Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions. |
CVE-2026-28188 | High | 7.3 | 2026-08-13 | Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions. |
CVE-2026-28186 | High | 8.1 | 2026-08-13 | Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. |
CVE-2026-28181 | Medium | 6.5 | 2026-08-13 | Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions. |
CVE-2026-28173 | High | 7.1 | 2026-08-13 | Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions. |
CVE-2026-28159 | Medium | 6.5 | 2026-08-13 | Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions. |
CVE-2026-27999 | Medium | 6.5 | 2026-08-13 | Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. |
CVE-2026-27535 | High | 7.1 | 2026-08-13 | Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. |
CVE-2026-27345 | High | 7.5 | 2026-08-13 | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions. |
CVE-2026-6471 | High | 7.2 | 2026-08-13 | Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system ac… |
CVE-2026-6470 | Medium | 4.3 | 2026-08-13 | Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a depen… |
CVE-2026-73609 | Medium | 5.8 | 2026-08-13 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspa… |
CVE-2026-73608 | High | 8.6 | 2026-08-13 | SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vuln… |
CVE-2026-73607 | Medium | 5.8 | 2026-08-13 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization che… |
CVE-2026-73605 | Medium | 5.8 | 2026-08-13 | SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existe… |
CVE-2026-73603 | | | 2026-08-13 | Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS cre… |
CVE-2026-14332 | Medium | 5.4 | 2026-08-13 | The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-man… |
CVE-2026-49819 | Critical | 9.8 | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperus… |
CVE-2026-47718 | | | 2026-08-12 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token req… |
CVE-2026-73326 | High | 7.6 | 2026-08-12 | CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching f… |
CVE-2026-72808 | Medium | 5.8 | 2026-08-12 | SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, whic… |
CVE-2026-72806 | Medium | 5.8 | 2026-08-12 | SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password prote… |
CVE-2026-72805 | Medium | 5.8 | 2026-08-12 | SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of… |
CVE-2026-72803 | Medium | 5.8 | 2026-08-12 | SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attribu… |
CVE-2026-72800 | Medium | 5.8 | 2026-08-12 | SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve compl… |
CVE-2026-72799 | Medium | 5.8 | 2026-08-12 | SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, ge… |
CVE-2026-72798 | High | 8.6 | 2026-08-12 | SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup… |
CVE-2026-72797 | Medium | 5.8 | 2026-08-12 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identi… |
CVE-2026-72796 | Medium | 5.8 | 2026-08-12 | SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the… |
CVE-2026-72795 | High | 8.6 | 2026-08-12 | SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attacker… |
CVE-2026-72791 | Medium | 5.8 | 2026-08-12 | SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/… |
CVE-2026-72790 | Medium | 5.8 | 2026-08-12 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without auth… |
CVE-2026-72789 | High | 8.6 | 2026-08-12 | SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can… |
CVE-2026-6821 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-63300 | Critical | 9.9 | 2026-08-12 | An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_inst… |
CVE-2026-4879 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-19656 | Critical | 9.9 | 2026-08-12 | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-… |
CVE-2026-16494 | High | 7.1 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allo… |
CVE-2026-73301 | Medium | 4.3 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted… |
CVE-2026-18244 | Medium | 4.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-73296 | Critical | 9.4 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mo… |
CVE-2026-70547 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access package metadata under specific conditions. |
CVE-2026-69107 | Medium | 5.9 | 2026-08-12 | An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions. |
CVE-2026-68971 | Medium | 6.5 | 2026-08-12 | Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` autho… |
CVE-2026-68758 | Medium | 6.5 | 2026-08-12 | A low-privileged authenticated user may access restricted support information under specific conditions. |
CVE-2026-65938 | Medium | 4.3 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke… |
CVE-2026-65926 | Low | 3.1 | 2026-08-12 | An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundl… |
CVE-2026-73405 | | | 2026-08-12 | An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through… |
CVE-2026-73287 | Medium | 5.4 | 2026-08-12 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/dr… |
CVE-2026-73265 | Medium | 6.5 | 2026-08-12 | RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy so… |
CVE-2026-68754 | Medium | 6.5 | 2026-08-12 | A repository publisher without delete permission may modify protected package content under specific conditions. |
CVE-2026-68753 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. |
CVE-2026-66380 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. |