Export limit exceeded: 12685 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12685 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-6471 | 1 Postgresql | 1 Postgresql | 2026-08-13 | 7.2 High |
| Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. | ||||
| CVE-2026-28173 | 2 Arraytics, Wordpress | 2 Wp Event Solution, Wordpress | 2026-08-13 | 7.1 High |
| Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions. | ||||
| CVE-2026-28181 | 2 Acymailing Newsletter Team, Wordpress | 2 Acymailing Smtp Newsletter, Wordpress | 2026-08-13 | 6.5 Medium |
| Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions. | ||||
| CVE-2026-61984 | 2 Amauri, Wordpress | 2 Wpmobile.app, Wordpress | 2026-08-13 | 7.5 High |
| Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | ||||
| CVE-2026-58482 | 2 Jovancoding, Network-ai | 2 Network-ai, Network-ai | 2026-08-13 | 5.9 Medium |
| Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret. | ||||
| CVE-2026-72921 | 1 Seaweedfs | 1 Seaweedfs | 2026-08-13 | 8.1 High |
| SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24. | ||||
| CVE-2026-72737 | 1 Dokploy | 1 Dokploy | 2026-08-13 | 9.6 Critical |
| Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's service host, read that organization's backup objects, or redirect and poison backups across tenant boundaries. | ||||
| CVE-2026-70547 | 1 Jfrog | 1 Artifactory | 2026-08-13 | 4.3 Medium |
| An authenticated user without repository read permission may access package metadata under specific conditions. | ||||
| CVE-2026-6821 | 1 Gitlab | 1 Gitlab | 2026-08-13 | 4.3 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint. | ||||
| CVE-2026-66441 | 2 Multivendorx, Wordpress | 2 Multivendorx, Wordpress | 2026-08-13 | 7.5 High |
| Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions. | ||||
| CVE-2026-66378 | 1 Jfrog | 1 Artifactory | 2026-08-13 | 4.3 Medium |
| An authenticated user without repository read permission may access private NuGet metadata under specific conditions. | ||||
| CVE-2026-66377 | 1 Jfrog | 1 Artifactory | 2026-08-13 | 5.3 Medium |
| An unauthenticated user may access restricted repository information under specific conditions. | ||||
| CVE-2026-64954 | 1 Rapid7 | 1 Velociraptor | 2026-08-13 | 8.2 High |
| Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role. | ||||
| CVE-2026-27535 | 2 Solacewp, Wordpress | 2 Solace Extra, Wordpress | 2026-08-13 | 7.1 High |
| Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. | ||||
| CVE-2026-62775 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-08-13 | 5.5 Medium |
| Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-61936 | 1 Microsoft | 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-08-13 | 5.5 Medium |
| Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-73213 | 1 Coturn | 1 Coturn | 2026-08-13 | 9.9 Critical |
| Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0. | ||||
| CVE-2026-63297 | 1 Canonical | 1 Lxd | 2026-08-13 | 9.9 Critical |
| An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls. | ||||
| CVE-2026-63296 | 1 Canonical | 1 Lxd | 2026-08-13 | 9.9 Critical |
| An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls. | ||||
| CVE-2026-63295 | 1 Canonical | 1 Lxd | 2026-08-13 | 4.3 Medium |
| An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints. | ||||