Export limit exceeded: 14161 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14161 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-50623 | 1 Apache | 1 Cxf | 2026-08-07 | 4.8 Medium |
| An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue. | ||||
| CVE-2025-70962 | 1 Zositech | 1 Zosi C519m | 2026-08-07 | 7.5 High |
| Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage. | ||||
| CVE-2026-15230 | 2 Wordpress, Yaycommerce | 2 Wordpress, Yaypricing | 2026-08-07 | 8.1 High |
| The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes. | ||||
| CVE-2026-56157 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-07 | 5.4 Medium |
| Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-9192 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-08-07 | 9.8 Critical |
| An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators. | ||||
| CVE-2026-70442 | 1 Jenkins Project | 1 Jenkins Google Chat Notification Plugin | 2026-08-07 | 4.3 Medium |
| Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use. | ||||
| CVE-2026-70447 | 1 Jenkins Project | 1 Jenkins Aws Codebuild Plugin | 2026-08-07 | 4.3 Medium |
| Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-15459 | 2 Wordpress, Wpmudev | 2 Wordpress, Wpmu Dev Dashboard | 2026-08-07 | 8.1 High |
| The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected. | ||||
| CVE-2025-11850 | 1 Wso2 | 3 Identity Server, Token Exchange Grant Type For Oauth, Wso2 Identity Server | 2026-08-07 | 4.3 Medium |
| When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store. If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique. | ||||
| CVE-2026-65542 | 2 Rajat Varlani, Wordpress | 2 Super Socializer, Wordpress | 2026-08-07 | 8.8 High |
| Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | ||||
| CVE-2026-57088 | 1 Microsoft | 6 Windows 10 1809, Windows Server 2019, Windows Server 2019 (server Core Installation) and 3 more | 2026-08-07 | 7.8 High |
| Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58540 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 7.8 High |
| Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58545 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 5.5 Medium |
| Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-47301 | 1 Microsoft | 4 Configuration Manager, Configuration Manager 2503, Configuration Manager 2509 and 1 more | 2026-08-07 | 8.8 High |
| Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-15210 | 2 Glboy, Wordpress | 2 Otp Login With Phone Number, Otp Verification, Wordpress | 2026-08-07 | 9.1 Critical |
| The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's. | ||||
| CVE-2026-15372 | 2 Wordpress, Wp2fac | 2 Wordpress, Wp2fac | 2026-08-07 | 7.5 High |
| The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts. | ||||
| CVE-2026-15573 | 1 Redhat | 9 Build Keycloak, Build Of Keycloak, Data Grid and 6 more | 2026-08-07 | 8.1 High |
| A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see. | ||||
| CVE-2026-13703 | 2 Clogica, Wordpress | 2 Seo Redirection Plugin, Wordpress | 2026-08-07 | 5.4 Medium |
| The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs. | ||||
| CVE-2025-14779 | 1 Wso2 | 4 Identity Server, Wso2 Carbon Identity Api Server Secret Management Common, Wso2 Carbon Identity Api Server Secret Management V1 and 1 more | 2026-08-07 | 3.8 Low |
| The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators. | ||||
| CVE-2026-15599 | 1 Tubitak Bilgem Software Technologies Research Institute | 1 Pardus Domain Joiner | 2026-08-07 | 3.3 Low |
| Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-domain-joiner: before 0.5.5. | ||||