Export limit exceeded: 12680 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12680 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-24791 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | 8.1 High |
| Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | ||||
| CVE-2026-72722 | 1 Discourse | 1 Discourse | 2026-08-13 | 4.3 Medium |
| Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. | ||||
| CVE-2026-47127 | 1 Ghostfolio | 1 Ghostfolio | 2026-08-13 | 6.5 Medium |
| Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's `client_reference_id` — without ever checking `session.payment_status` or `session.status`. There is no separate Stripe webhook endpoint with `stripe-signature` verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless `session.payment_status === 'paid'` AND `session.status === 'complete'` (fails closed). Additionally, new unique `stripeCheckoutSessionId` column → a session can't be redeemed twice (race-safe via DB unique constraint). | ||||
| CVE-2026-48375 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 6.5 Medium |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-14332 | 2 Ecwid, Wordpress | 2 Ecwid By Lightspeed Ecommerce Shopping Cart, Wordpress | 2026-08-13 | 5.4 Medium |
| The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it. | ||||
| CVE-2026-73571 | 1 Zimbra | 1 Collaboration | 2026-08-13 | 3.1 Low |
| An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler. | ||||
| CVE-2026-73403 | 2 Wordpress, Wpeverest | 2 Wordpress, User Registration | 2026-08-13 | 5.3 Medium |
| Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. | ||||
| CVE-2026-73287 | 1 Rustfs | 1 Rustfs | 2026-08-13 | 5.4 Medium |
| RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.create_bucket without authorize_operation for S3Action::CreateBucket, allowing authenticated FTPS users denied s3:CreateBucket to create buckets. This issue is fixed in version 1.0.0-beta.12. | ||||
| CVE-2026-73265 | 1 Rustfs | 1 Rustfs | 2026-08-13 | 6.5 Medium |
| RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11. | ||||
| CVE-2026-47233 | 1 Admidio | 1 Admidio | 2026-08-13 | 6.5 Medium |
| Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix. | ||||
| CVE-2026-66660 | 2 Scottpaterson, Wordpress | 2 Contact Form 7 – Paypal & Stripe Add-on, Wordpress | 2026-08-13 | 6.5 Medium |
| Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions. | ||||
| CVE-2026-25652 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 7.8 High |
| is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-66693 | 2 Stylemix, Wordpress | 2 Motors, Wordpress | 2026-08-13 | 6.5 Medium |
| Subscriber Broken Access Control in Motors <= 1.4.113 versions. | ||||
| CVE-2026-73349 | 2 Nexcess, Wordpress | 2 Givewp, Wordpress | 2026-08-13 | 5.3 Medium |
| Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | ||||
| CVE-2026-6471 | 1 Postgresql | 1 Postgresql | 2026-08-13 | 7.2 High |
| Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. | ||||
| CVE-2026-28173 | 2 Arraytics, Wordpress | 2 Wp Event Solution, Wordpress | 2026-08-13 | 7.1 High |
| Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions. | ||||
| CVE-2026-28181 | 2 Acymailing Newsletter Team, Wordpress | 2 Acymailing Smtp Newsletter, Wordpress | 2026-08-13 | 6.5 Medium |
| Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions. | ||||
| CVE-2026-61984 | 2 Amauri, Wordpress | 2 Wpmobile.app, Wordpress | 2026-08-13 | 7.5 High |
| Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | ||||
| CVE-2026-58482 | 2 Jovancoding, Network-ai | 2 Network-ai, Network-ai | 2026-08-13 | 5.9 Medium |
| Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret. | ||||
| CVE-2026-72921 | 1 Seaweedfs | 1 Seaweedfs | 2026-08-13 | 8.1 High |
| SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24. | ||||