CVE-2026-109119 | High | 8.8 | 2026-10-16 | Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privile… |
CVE-2026-18799 | Medium | 4.3 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administra… |
CVE-2026-19798 | Medium | 4.3 | 2026-10-16 | The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() funct… |
CVE-2026-18795 | Medium | 6.4 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authent… |
CVE-2026-110366 | Medium | 5.3 | 2026-10-16 | Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-107770 | Medium | 6.8 | 2026-10-16 | The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is d… |
CVE-2026-110721 | Medium | 5.3 | 2026-10-16 | The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 Th… |
CVE-2026-110590 | High | 7.5 | 2026-10-16 | The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin no… |
CVE-2026-110019 | Medium | 4.3 | 2026-10-16 | The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plu… |
CVE-2026-107746 | High | 7.5 | 2026-10-16 | The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0… |
CVE-2026-107659 | High | 7.5 | 2026-10-16 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2026-109812 | | | 2026-10-16 | A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authentic… |
CVE-2026-92629 | High | 7.3 | 2026-10-16 | A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a lo… |
CVE-2026-111353 | Medium | 4.3 | 2026-10-15 | Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other user… |
CVE-2026-111350 | Medium | 5.0 | 2026-10-15 | Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams… |
CVE-2026-111349 | Medium | 5.3 | 2026-10-15 | Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer re… |
CVE-2026-111343 | Medium | 4.3 | 2026-10-15 | pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via… |
CVE-2026-111277 | High | 7.5 | 2026-10-15 | NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrie… |
CVE-2026-105039 | Critical | 9.6 | 2026-10-15 | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user… |
CVE-2026-96449 | Medium | 5.3 | 2026-10-15 | Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-111235 | Critical | 9.1 | 2026-10-15 | An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains a… |
CVE-2026-110378 | Medium | 5.3 | 2026-10-15 | Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly… |
CVE-2026-110374 | Medium | 4.3 | 2026-10-15 | Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-110364 | Medium | 5.3 | 2026-10-15 | Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-… |
CVE-2026-110362 | Medium | 5.3 | 2026-10-15 | Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access… |
CVE-2026-110360 | Medium | 5.3 | 2026-10-15 | Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-109897 | Medium | 5.4 | 2026-10-15 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-109689 | Medium | 5.3 | 2026-10-15 | Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-108499 | Medium | 5.3 | 2026-10-15 | Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-55414 | Medium | 5.3 | 2026-10-15 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-110891 | Medium | 5.4 | 2026-10-15 | Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-110888 | Medium | 4.3 | 2026-10-15 | Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-110371 | Medium | 4.3 | 2026-10-15 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-110367 | Medium | 5.3 | 2026-10-15 | Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-97712 | | | 2026-10-15 | Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. Th… |
CVE-2026-97665 | | | 2026-10-15 | A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to… |
CVE-2026-75505 | | | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known a… |
CVE-2026-111092 | Medium | 6.5 | 2026-10-15 | In JetBrains YouTrack before 2026.2.19575
2026.3.16075
2026.3.16397
2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands |
CVE-2026-46708 | Medium | 4.3 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt… |
CVE-2026-46694 | Medium | 6.5 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch… |
CVE-2026-46691 | Medium | 6.5 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Im… |
CVE-2026-109692 | High | 7.1 | 2026-10-15 | Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-96537 | High | 7.5 | 2026-10-15 | The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated user… |
CVE-2026-11905 | Medium | 4.3 | 2026-10-15 | The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i… |
CVE-2026-104643 | Medium | 4.2 | 2026-10-15 | The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user… |
CVE-2026-103304 | Medium | 5.3 | 2026-10-15 | The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing… |
CVE-2026-17031 | High | 8.1 | 2026-10-15 | The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-76066 | High | 7.5 | 2026-10-15 | IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the p… |
CVE-2026-107795 | | | 2026-10-14 | Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user… |
CVE-2026-102298 | | | 2026-10-14 | In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controll… |
CVE-2026-71854 | High | 8.2 | 2026-10-14 | OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.26062… |
CVE-2026-61843 | High | 8.2 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder… |
CVE-2026-102985 | Medium | 6.5 | 2026-10-14 | Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role upda… |
CVE-2026-110773 | Medium | 4.3 | 2026-10-14 | GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all o… |
CVE-2026-110772 | Medium | 4.3 | 2026-10-14 | Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to byp… |
CVE-2026-102748 | | | 2026-10-14 | Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication wh… |
CVE-2026-102682 | Medium | 5.6 | 2026-10-14 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's… |
CVE-2026-88164 | High | 8.8 | 2026-10-14 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-108480 | High | 8.2 | 2026-10-14 | Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sk… |
CVE-2026-91156 | High | 7.5 | 2026-10-14 | Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages fr… |
CVE-2026-100404 | Medium | 6.5 | 2026-10-14 | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside… |
CVE-2026-110629 | Medium | 6.5 | 2026-10-14 | VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through… |
CVE-2026-110624 | Low | 3.1 | 2026-10-14 | Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by s… |
CVE-2026-110623 | High | 7.5 | 2026-10-14 | Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' docu… |
CVE-2026-110622 | High | 7.5 | 2026-10-14 | Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page mana… |
CVE-2026-110621 | High | 8.8 | 2026-10-14 | Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary p… |
CVE-2026-110617 | Medium | 4.8 | 2026-10-14 | we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers t… |
CVE-2026-110615 | High | 7.1 | 2026-10-14 | jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to ch… |
CVE-2025-71433 | High | 7.5 | 2026-10-14 | Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label… |
CVE-2026-82026 | High | 8.8 | 2026-10-14 | Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticate… |
CVE-2026-107433 | Medium | 6.5 | 2026-10-14 | Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-107426 | High | 7.3 | 2026-10-14 | Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-107425 | Medium | 6.5 | 2026-10-14 | Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Inco… |
CVE-2026-107417 | Medium | 6.5 | 2026-10-14 | Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploit… |
CVE-2026-107431 | High | 7.5 | 2026-10-14 | Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-110227 | Medium | 5.3 | 2026-10-14 | Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-103907 | Medium | 6.5 | 2026-10-14 | The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block'… |
CVE-2026-94360 | Medium | 5.3 | 2026-10-14 | The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an orde… |
CVE-2026-94260 | Medium | 5.3 | 2026-10-14 | The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, all… |
CVE-2026-94254 | Medium | 5.3 | 2026-10-14 | The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthentic… |
CVE-2026-91076 | Medium | 5.3 | 2026-10-14 | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before… |
CVE-2026-108064 | Medium | 6.5 | 2026-10-14 | The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisio… |
CVE-2026-107158 | Medium | 5.3 | 2026-10-14 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the data… |
CVE-2026-106646 | Medium | 5.9 | 2026-10-14 | The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references… |
CVE-2026-105975 | Medium | 5.3 | 2026-10-14 | The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment… |
CVE-2026-104751 | Medium | 5.3 | 2026-10-14 | The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthen… |
CVE-2026-17092 | High | 8.1 | 2026-10-14 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… |
CVE-2026-103423 | High | 7.5 | 2026-10-14 | The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not prope… |
CVE-2026-110160 | Medium | 4.2 | 2026-10-13 | Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged s… |
CVE-2026-70098 | High | 8.8 | 2026-10-13 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-63174 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside the… |
CVE-2026-63172 | High | 7.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts… |
CVE-2026-56826 | Medium | 5.4 | 2026-10-13 | Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could dir… |
CVE-2026-96926 | Medium | 5.5 | 2026-10-13 | Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. |
CVE-2026-96855 | Medium | 5.5 | 2026-10-13 | Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
CVE-2026-96316 | Medium | 5.5 | 2026-10-13 | Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally. |
CVE-2026-96315 | Medium | 5.5 | 2026-10-13 | Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally. |
CVE-2026-96311 | Medium | 5.5 | 2026-10-13 | Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally. |
CVE-2026-88198 | High | 8.8 | 2026-10-13 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-88135 | High | 7.8 | 2026-10-13 | Improper access control in WebDAV allows an authorized attacker to elevate privileges locally. |