Export limit exceeded: 15596 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15596 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105860 | 1 Payloadcms | 1 Payload | 2026-10-15 | 7.1 High |
| Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | ||||
| CVE-2026-105864 | 1 Payloadcms | 2 Payload, Plugin-multi-tenant | 2026-10-15 | 4.3 Medium |
| Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | ||||
| CVE-2026-14273 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 6.5 Medium |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization. | ||||
| CVE-2026-16275 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 5.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks. | ||||
| CVE-2026-74769 | 1 Dell | 1 Powerprotect Data Manager | 2026-10-14 | 6.5 Medium |
| Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass. | ||||
| CVE-2026-110211 | 1 Iflytek | 1 Skillhub | 2026-10-14 | 8.1 High |
| iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata. | ||||
| CVE-2026-110762 | 1 Bbpress | 1 Bbpress | 2026-10-14 | 3.7 Low |
| bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint. | ||||
| CVE-2026-110629 | 2026-10-14 | 6.5 Medium | ||
| VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices. | ||||
| CVE-2026-9268 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 2.7 Low |
| GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks. | ||||
| CVE-2026-92528 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 4.2 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution. | ||||
| CVE-2026-85529 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 5.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API. | ||||
| CVE-2026-84284 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 5.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks. | ||||
| CVE-2026-16301 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 8.5 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service. | ||||
| CVE-2026-14552 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 4.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks. | ||||
| CVE-2026-71854 | 2026-10-14 | 8.2 High | ||
| OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch. | ||||
| CVE-2026-102862 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 8.8 High |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102861 | 1 Microsoft | 2 Sharepoint Server, Sharepoint Server Subscription Edition | 2026-10-14 | 8.8 High |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-103549 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 2.7 Low |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks. | ||||
| CVE-2026-77910 | 1 Microsoft | 7 Exchange Server 2016, Exchange Server 2019, Exchange Server Se and 4 more | 2026-10-14 | 8.8 High |
| Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-106340 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-14 | 4.6 Medium |
| Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low) | ||||