Export limit exceeded: 11268 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11268 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-28850 | 1 Apple | 1 Visionos | 2026-10-26 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.8, visionOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-91505 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-10-26 | 6 Medium |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). | ||||
| CVE-2026-60885 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-10-26 | 6.8 Medium |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-115598 | 2 Thimpress, Wordpress-extensions | 2 Learnpress, Learnpress | 2026-10-26 | 5.3 Medium |
| Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11. | ||||
| CVE-2026-111638 | 1 Moul | 1 Sshportal | 2026-10-26 | 7.7 High |
| sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording. | ||||
| CVE-2026-111683 | 1 Allegro | 1 Ralph | 2026-10-26 | 5.4 Medium |
| Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks. | ||||
| CVE-2026-109369 | 2 Murgroland, Wordpress-extensions | 2 Wp Booking System – Booking Calendar, Wp Booking System | 2026-10-26 | 6.8 Medium |
| The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id. | ||||
| CVE-2026-113875 | 1 Smilecdr | 1 Hapi Fhir | 2026-10-26 | 3.1 Low |
| On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access. | ||||
| CVE-2026-114354 | 1 Dji | 1 Crystalsky Zs600c | 2026-10-26 | N/A |
| Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check. | ||||
| CVE-2026-114356 | 1 Dji | 1 Crystalsky Zs600c | 2026-10-26 | N/A |
| Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check. | ||||
| CVE-2026-93328 | 1 Google | 1 Mcp Toolbox For Databases | 2026-10-26 | N/A |
| Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. | ||||
| CVE-2026-105765 | 1 Hashicorp | 2 Consul, Consul Enterprise | 2026-10-26 | 7.5 High |
| HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. | ||||
| CVE-2026-116388 | 2026-10-26 | 5.3 Medium | ||
| Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10. | ||||
| CVE-2026-115597 | 2026-10-26 | 5.4 Medium | ||
| Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11. | ||||
| CVE-2026-112839 | 2026-10-26 | 4.3 Medium | ||
| Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14. | ||||
| CVE-2026-76308 | 1 Splunk | 1 Splunk | 2026-10-26 | 6.5 Medium |
| In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Obtain and configure a Splunk SOAR (On-premises) license (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license), and Integration of Splunk SOAR with Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security) in the Splunk documentation. | ||||
| CVE-2026-76304 | 1 Splunk | 1 Splunk | 2026-10-26 | 4.3 Medium |
| In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator (URL) of the Splunk SOAR instance, the container image location, and the Splunk SOAR Automation Broker version. The vulnerability is possible because Splunk SOAR returns the configuration file without enforcing the Automation Broker edit permission. For more information see Install Splunk Automation Broker on a Docker host (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/install-and-create-classic-splunk-soar-automation-brokers/install-splunk-automation-broker-on-a-docker-host) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation. | ||||
| CVE-2026-76296 | 1 Splunk | 1 Splunk Enterprise | 2026-10-26 | 4.3 Medium |
| In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations. For more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation. | ||||
| CVE-2026-109356 | 1 Librenms | 1 Librenms | 2026-10-26 | 4.3 Medium |
| LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices. | ||||
| CVE-2026-109171 | 1 Guchengwuyue | 1 Yshop-crm | 2026-10-26 | 4.3 Medium |
| yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock. | ||||