Export limit exceeded: 15742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15742 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-6723 | 2 Croixhaug, Wordpress-extensions | 2 Simply Schedule Appointments, Simply Schedule Appointments | 2026-10-19 | 5.3 Medium |
| The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type. | ||||
| CVE-2026-18947 | 2 Red Hat, Redhat | 2 Red Hat Openshift Ai (rhoai), Openshift Ai | 2026-10-19 | 8.5 High |
| A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants. | ||||
| CVE-2026-57727 | 2 Themeum, Wordpress | 2 Kirki, Wordpress | 2026-10-19 | 7.5 High |
| Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0. | ||||
| CVE-2026-107418 | 2 Arraytics, Wordpress-extensions | 2 Booktics, Booktics | 2026-10-18 | 5.4 Medium |
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28. | ||||
| CVE-2026-109703 | 2 Wordpress-extensions, Wpgraphql | 2 Wpgraphql, Wpgraphql | 2026-10-18 | 5.3 Medium |
| Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1. | ||||
| CVE-2026-92817 | 1 Inductiveautomation | 1 Ignition | 2026-10-18 | 8.8 High |
| The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process. | ||||
| CVE-2026-78433 | 1 Gitea | 1 Gitea | 2026-10-18 | 5.9 Medium |
| Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker. | ||||
| CVE-2026-73804 | 1 Gitea | 1 Gitea | 2026-10-18 | 8.1 High |
| Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions. | ||||
| CVE-2026-70396 | 1 Gitea | 1 Gitea | 2026-10-18 | 5.4 Medium |
| Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions. | ||||
| CVE-2026-74032 | 1 Wazuh | 1 Wazuh | 2026-10-18 | 4.3 Medium |
| Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resources, which omit the caller's RBAC policies, to map privileged actions and endpoints for privilege escalation planning. | ||||
| CVE-2026-63172 | 1 Omnispace | 1 Agora Project | 2026-10-18 | 7.1 High |
| Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation. | ||||
| CVE-2026-109665 | 1 Frappe | 1 Erpnext | 2026-10-18 | 4.3 Medium |
| Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role. | ||||
| CVE-2026-109660 | 1 Frappe | 1 Erpnext | 2026-10-18 | 6.5 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits. | ||||
| CVE-2026-109655 | 1 Frappe | 1 Erpnext | 2026-10-18 | 6.5 Medium |
| Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role. | ||||
| CVE-2026-109650 | 1 Frappe | 1 Erpnext | 2026-10-18 | 6.5 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits. | ||||
| CVE-2026-109645 | 1 Frappe | 1 Erpnext | 2026-10-18 | 6.5 Medium |
| Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions. | ||||
| CVE-2026-109635 | 1 Frappe | 1 Erpnext | 2026-10-18 | 4.3 Medium |
| Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own. | ||||
| CVE-2026-109630 | 1 Frappe | 1 Erpnext | 2026-10-18 | 4.3 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits. | ||||
| CVE-2026-109625 | 1 Frappe | 1 Erpnext | 2026-10-18 | 6.5 Medium |
| Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role. | ||||
| CVE-2026-109617 | 1 Frappe | 1 Erpnext | 2026-10-18 | 7.1 High |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions. | ||||