Export limit exceeded: 27756 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 14995 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3842 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85697 | 1 Documenso | 1 Documenso | 2026-09-04 | 6.5 Medium |
| Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers. | ||||
| CVE-2026-85619 | 1 Appflowy-io | 1 Appflowy-cloud | 2026-09-04 | 7.5 High |
| AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data. | ||||
| CVE-2026-16941 | 1 Ibm | 1 I | 2026-09-04 | 4.3 Medium |
| IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization. | ||||
| CVE-2026-78609 | 1 Elastic | 2 Eck Operator, Elastic Cloud On Kubernetes | 2026-09-04 | 5.4 Medium |
| Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace. | ||||
| CVE-2026-85622 | 1 Appflowy-io | 1 Appflowy-cloud | 2026-09-04 | 5.3 Medium |
| AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement. | ||||
| CVE-2026-85512 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-09-04 | 7.3 High |
| A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-4644 | 1 Google Cloud | 1 Integration Connectors | 2026-09-04 | N/A |
| A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This vulnerability was patched on 11 December 2025, and no customer action is needed. | ||||
| CVE-2025-15691 | 2026-09-04 | 5.3 Medium | ||
| The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths. | ||||
| CVE-2026-19283 | 1 Ibm | 1 Observability With Instana Agent | 2026-09-04 | 7.7 High |
| IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace. | ||||
| CVE-2026-85620 | 1 Crystaldba | 1 Postgres-mcp | 2026-09-04 | 8.6 High |
| Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections. | ||||
| CVE-2026-56152 | 1 Elastic | 2 Elastic Defend, Endpoint Security | 2026-09-04 | 5.3 Medium |
| Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view. | ||||
| CVE-2026-85587 | 2 Phpmyfaq, Thorsten | 2 Phpmyfaq, Phpmyfaq | 2026-09-04 | N/A |
| phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public. | ||||
| CVE-2026-85592 | 2 Phpmyfaq, Thorsten | 2 Phpmyfaq, Phpmyfaq | 2026-09-04 | 3.7 Low |
| phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue. | ||||
| CVE-2026-85597 | 1 Traefik | 1 Traefik | 2026-09-04 | N/A |
| Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts. | ||||
| CVE-2026-85538 | 1 Misp | 1 Misp | 2026-09-04 | N/A |
| An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions. The affected attribute deletion paths relied on organization membership checks performed by MispAttribute::deleteAttribute() but did not consistently enforce MISP's event modification authorization rules. Consequently, a user belonging to the organization associated with an event could potentially delete individual attributes or perform bulk attribute deletion even when their assigned role was not authorized to modify the event. This created an inconsistency between attribute editing and deletion: editing an attribute correctly used MISP's ACL::canModifyEvent() authorization logic, whereas the affected deletion operations could bypass these permission checks. An authenticated attacker with access to an affected MISP instance and membership in the organization owning an event could exploit this flaw to remove attributes from that event, potentially causing unauthorized modification or loss of threat intelligence data. The patch introduces a common authorization check for all affected deletion paths. Before deletion, MISP now resolves the associated events and verifies that the current user is authorized to modify each event using the same authorization mechanism used by normal event and attribute modification operations. | ||||
| CVE-2026-84206 | 2 Grokability, Snipeitapp | 2 Snipe-it, Snipe-it | 2026-09-04 | 4.3 Medium |
| Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation. | ||||
| CVE-2026-82302 | 1 Elastic | 1 Kibana | 2026-09-03 | 8.1 High |
| Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). | ||||
| CVE-2026-18255 | 1 Redhat | 2 Quay, Quay 3 | 2026-09-03 | 7.2 High |
| A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account. | ||||
| CVE-2026-78583 | 1 Elastic | 1 Kibana | 2026-09-03 | 8.1 High |
| Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration. | ||||
| CVE-2026-82298 | 1 Elastic | 1 Kibana | 2026-09-03 | 4.3 Medium |
| Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). | ||||