CVE-2026-109561 | Medium | 4.2 | 2026-10-12 | goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because p… |
CVE-2026-109560 | High | 7.5 | 2026-10-12 | Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them aft… |
CVE-2026-109559 | High | 8.7 | 2026-10-12 | EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix… |
CVE-2026-109376 | Medium | 4.3 | 2026-10-12 | ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view pr… |
CVE-2026-104355 | | | 2026-10-12 | A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applie… |
CVE-2026-77366 | Critical | 9.9 | 2026-10-12 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled… |
CVE-2026-109374 | Medium | 5.5 | 2026-10-12 | ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrato… |
CVE-2026-109336 | Medium | 4.3 | 2026-10-12 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through… |
CVE-2026-109302 | Low | 3.7 | 2026-10-12 | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request… |
CVE-2026-109285 | Medium | 5.0 | 2026-10-12 | Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep… |
CVE-2026-109283 | Medium | 5.4 | 2026-10-12 | Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's us… |
CVE-2026-92682 | | | 2026-10-12 | In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not nega… |
CVE-2026-109182 | Medium | 4.3 | 2026-10-12 | jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope res… |
CVE-2026-109181 | Medium | 4.3 | 2026-10-12 | jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users… |
CVE-2026-109174 | Medium | 6.5 | 2026-10-12 | MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemCo… |
CVE-2026-108951 | Medium | 6.5 | 2026-10-12 | LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by ab… |
CVE-2026-85499 | | | 2026-10-12 | Improper Authorization vulnerability in Apache SkyWalking BanyanDB.
The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality… |
CVE-2026-103903 | High | 8.8 | 2026-10-12 | An incorrect authorization vulnerability in the WinBox
authentication flow of MikroTik RouterOS allows a remote authenticated attacker
with credentials for a l… |
CVE-2026-107203 | Medium | 5.4 | 2026-10-12 | An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks onl… |
CVE-2026-108746 | High | 8.8 | 2026-10-11 | Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege l… |
CVE-2026-108729 | Medium | 5.9 | 2026-10-11 | Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download p… |
CVE-2026-108711 | Medium | 4.3 | 2026-10-11 | Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data… |
CVE-2026-81649 | Critical | 9.1 | 2026-10-11 | The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credentia… |
CVE-2026-107507 | Low | 2.7 | 2026-10-11 | The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer r… |
CVE-2026-108695 | High | 7.1 | 2026-10-11 | MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings… |
CVE-2026-108604 | Medium | 6.3 | 2026-10-10 | Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP… |
CVE-2026-108595 | Medium | 5.3 | 2026-10-10 | Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplyi… |
CVE-2026-108586 | Medium | 5.4 | 2026-10-10 | 1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope en… |
CVE-2026-108550 | High | 8.8 | 2026-10-10 | SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers… |
CVE-2026-108114 | Medium | 4.3 | 2026-10-10 | Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the… |
CVE-2026-105976 | Medium | 4.7 | 2026-10-10 | The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least… |
CVE-2026-6723 | Medium | 5.3 | 2026-10-10 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up… |
CVE-2026-108263 | Critical | 9.9 | 2026-10-09 | Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workf… |
CVE-2026-107851 | Medium | 4.3 | 2026-10-09 | Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAcces… |
CVE-2026-107841 | Medium | 5.7 | 2026-10-09 | pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer… |
CVE-2026-107822 | Medium | 6.4 | 2026-10-09 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache cou… |
CVE-2026-78341 | Medium | 6.5 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker w… |
CVE-2026-101028 | | | 2026-10-09 | Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and As… |
CVE-2026-107728 | High | 7.5 | 2026-10-08 | Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates… |
CVE-2026-107782 | High | 7.8 | 2026-10-08 | System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs… |
CVE-2026-107706 | Medium | 4.3 | 2026-10-08 | Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission befo… |
CVE-2026-97147 | | | 2026-10-08 | In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then… |
CVE-2026-93861 | | | 2026-10-08 | In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a furthe… |
CVE-2026-107336 | Medium | 6.5 | 2026-10-08 | Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A re… |
CVE-2026-107334 | Medium | 5.4 | 2026-10-08 | Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin… |
CVE-2026-107333 | High | 8.1 | 2026-10-08 | Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer… |
CVE-2026-50055 | Medium | 6.5 | 2026-10-08 | A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send… |
CVE-2026-14273 | Medium | 6.5 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker… |
CVE-2026-71896 | Medium | 6.5 | 2026-10-08 | An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler… |
CVE-2026-71183 | High | 7.1 | 2026-10-08 | An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access… |
CVE-2026-66087 | High | 8.1 | 2026-10-08 | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to acc… |
CVE-2026-66084 | High | 8.1 | 2026-10-08 | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to a… |
CVE-2026-66082 | Medium | 6.5 | 2026-10-08 | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow… |
CVE-2026-107450 | Medium | 5.4 | 2026-10-08 | In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared Acces… |
CVE-2026-102488 | | | 2026-10-08 | In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permi… |
CVE-2026-107281 | | | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16… |
CVE-2026-107230 | High | 7.4 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14… |
CVE-2026-76264 | Medium | 4.3 | 2026-10-07 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scri… |
CVE-2026-62179 | Medium | 6.5 | 2026-10-07 | PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of… |
CVE-2026-106562 | Medium | 4.3 | 2026-10-07 | Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend… |
CVE-2026-106561 | Medium | 5.0 | 2026-10-07 | Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive infor… |
CVE-2026-43976 | High | 7.1 | 2026-10-07 | wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_… |
CVE-2026-105139 | Medium | 4.3 | 2026-10-07 | Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resourc… |
CVE-2026-92393 | | | 2026-10-07 | Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn ar… |
CVE-2026-81535 | | | 2026-10-07 | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. … |
CVE-2026-106471 | High | 8.1 | 2026-10-07 | A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible… |
CVE-2026-97626 | Medium | 4.3 | 2026-10-06 | Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the… |
CVE-2026-97208 | Medium | 4.9 | 2026-10-06 | The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mi… |
CVE-2026-89182 | Medium | 5.4 | 2026-10-06 | With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push opti… |
CVE-2026-86684 | High | 7.1 | 2026-10-06 | The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security]… |
CVE-2026-106498 | High | 7.7 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is… |
CVE-2026-106497 | Medium | 4.3 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalo… |
CVE-2026-106496 | Low | 3.1 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforc… |
CVE-2026-105268 | Medium | 4.3 | 2026-10-06 | The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comm… |
CVE-2026-105267 | High | 8.1 | 2026-10-06 | The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release del… |
CVE-2026-106492 | High | 7.6 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper pres… |
CVE-2026-106463 | Medium | 5.4 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by impro… |
CVE-2026-106462 | Medium | 6.4 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credent… |
CVE-2026-106461 | Medium | 4.3 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect author… |
CVE-2026-106458 | Medium | 6.5 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package i… |
CVE-2026-106456 | Medium | 4.8 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent… |
CVE-2026-96589 | Medium | 4.3 | 2026-10-06 | When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the… |
CVE-2026-94205 | Critical | 9.8 | 2026-10-06 | Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_… |
CVE-2026-79960 | High | 7.1 | 2026-10-06 | When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated th… |
CVE-2026-103007 | High | 7.2 | 2026-10-06 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced… |
CVE-2026-102412 | Medium | 6.5 | 2026-10-06 | Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1)… |
CVE-2026-102407 | Medium | 5.4 | 2026-10-06 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by AC… |
CVE-2026-106511 | Critical | 9.8 | 2026-10-06 | MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulne… |
CVE-2026-106422 | Medium | 4.3 | 2026-10-06 | Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium… |
CVE-2026-106407 | Medium | 6.5 | 2026-10-06 | Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass sy… |
CVE-2026-106404 | Medium | 6.5 | 2026-10-06 | Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass syst… |
CVE-2026-106403 | High | 8.1 | 2026-10-06 | Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-106402 | Medium | 4.8 | 2026-10-06 | Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via… |
CVE-2026-106398 | Medium | 4.3 | 2026-10-06 | Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-106397 | Medium | 6.1 | 2026-10-06 | Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system ac… |
CVE-2026-106391 | Medium | 4.2 | 2026-10-06 | Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-106389 | Medium | 6.5 | 2026-10-06 | Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrict… |
CVE-2026-106381 | Medium | 6.5 | 2026-10-06 | Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML… |
CVE-2026-106372 | Critical | 9.6 | 2026-10-06 | Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-106371 | High | 8.8 | 2026-10-06 | Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive informatio… |