Export limit exceeded: 423522 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11852 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-94618 | 1 Filegator | 1 Filegator | 2026-11-06 | 5.4 Medium |
| FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0. | ||||
| CVE-2026-27356 | 2026-11-06 | 5.3 Medium | ||
| Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1. | ||||
| CVE-2026-121552 | 1 Dromara | 1 Domain-admin | 2026-11-06 | 4.3 Medium |
| Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to. | ||||
| CVE-2026-65107 | 1 Nvidia | 1 Slurm | 2026-11-06 | 6.3 Medium |
| NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to. | ||||
| CVE-2026-105821 | 1 Tp-link | 1 Tapo Cloud Service | 2026-11-06 | N/A |
| The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID may obtain a device token scoped to the target device and use it to upload attacker-controlled content to the target user's Tapo Cloud storage. The content may then be presented in the Tapo app as a legitimate event. Successful exploitation may allow an attacker to upload attacker-controlled content that is presented to a target user as a legitimate Tapo event, retrieve internal service information through crafted proxy requests, or abuse Tapo Cloud outbound request capability in activity that could affect service availability. | ||||
| CVE-2026-121728 | 1 Sourcehut | 1 Meta.sr.ht | 2026-11-06 | 5.3 Medium |
| SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts. | ||||
| CVE-2026-121729 | 1 0xdps | 1 Emailflare | 2026-11-06 | 8.3 High |
| emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations. | ||||
| CVE-2026-123327 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.5 High |
| In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions | ||||
| CVE-2026-123337 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility | ||||
| CVE-2026-123300 | 1 Jetbrains | 1 Hub | 2026-11-06 | 2.7 Low |
| In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings | ||||
| CVE-2026-102340 | 1 Telepresenceio | 1 Telepresence | 2026-11-06 | 8.5 High |
| Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can register in an arbitrary managed namespace, create service intercepts, receive intercepted traffic, and obtain the victim pod's complete container environment, including secrets, tokens, and API keys. The default cluster-wide deployment manages all namespaces. This vulnerability is fixed in 2.31.0. | ||||
| CVE-2026-54383 | 1 Shenzhen Shine Industrial | 1 Vitafit | 2026-11-06 | 6.5 Medium |
| VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs. | ||||
| CVE-2026-121880 | 2 Posit, Posit Software, Pbc | 4 Rstudio Server, Workbench, Posit Workbench and 1 more | 2026-11-06 | N/A |
| Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session. NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying. | ||||
| CVE-2026-123331 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 5.4 Medium |
| In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles | ||||
| CVE-2026-123332 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 4.7 Medium |
| In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations | ||||
| CVE-2026-123335 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.5 Low |
| In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection | ||||
| CVE-2026-123330 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 5.4 Medium |
| In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings | ||||
| CVE-2026-116663 | 1 Tanium | 1 Enforce | 2026-11-06 | 6.5 Medium |
| Tanium addressed an improper access controls vulnerability in Enforce. | ||||
| CVE-2026-88800 | 2026-11-06 | 9.1 Critical | ||
| The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities. | ||||
| CVE-2026-119259 | 2026-11-06 | 5.3 Medium | ||
| The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit. | ||||