WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-284✕
Overview 8,953 matches · 2,665 in Waratek scope · 21 protected · 94 exploited · 39 CISA KEV · 159 public PoC · 51 EPSS ≥ 0.5
8,953matches 2,665in Waratek scope29.8% 21protected0.2% 94exploited1.0% 39CISA KEV0.4% 159public PoC1.8% 51EPSS ≥ 0.50.6%
Protected by Waratek 22 0.2% Rule in development 0 0.0% Mitigation candidate 3 0.0% No exploit published 2,640 29.5% Outside Waratek scope 83 0.9% Not applicable 6,205 69.3% Withdrawn CVE 0 0.0%
Critical 1,208 13.5% High 3,589 40.1% Medium 3,499 39.1% Low 654 7.3% None 0 0.0% Unknown 3 0.0%
blocked by ARMR today 21 0.2% partly blocked 1 0.0% not blocked 8,931 99.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 94 1.0% Working exploit published 82 0.9% Proof of concept only 1,482 16.6% Forecast only 3 0.0% No public exploit 7,292 81.4%
split by peak 4,645 / year
Not applicable: 6,205Outside Waratek scope: 83No exploit published: 2,640Mitigation candidate: 3Protected by Waratek: 22 Unknown: 3Low: 654Medium: 3,499High: 3,589Critical: 1,208 not blocked: 8,931partly blocked: 1blocked by ARMR today: 21 No public exploit: 7,292Forecast only: 3Proof of concept only: 1,482Working exploit published: 82Exploited: 94
20011 Not applicable1 High1 not blocked1 No public exploit1 20020 20030 20040 20050 20061 No exploit published1 Medium1 not blocked1 No public exploit1 20071 No exploit published1 Medium1 not blocked1 No public exploit1 20081 Not applicable1 Medium1 not blocked1 No public exploit1 20092 No exploit published1 Not applicable1 High1 Medium1 not blocked2 No public exploit2 20100 20112 No exploit published1 Outside Waratek scope1 Critical1 Medium1 not blocked2 Exploited1 No public exploit1 20129 No exploit published2 Outside Waratek scope3 Not applicable4 Critical3 Medium5 Low1 not blocked9 Exploited3 No public exploit6 201312 No exploit published4 Outside Waratek scope3 Not applicable5 Critical2 High4 Medium5 Low1 not blocked12 Exploited2 No public exploit10 201422 Protected by Waratek1 No exploit published2 Not applicable19 High6 Medium14 Low2 blocked by ARMR today1 not blocked21 Exploited1 No public exploit21 2015148 Protected by Waratek1 No exploit published9 Outside Waratek scope1 Not applicable137 Critical2 High63 Medium70 Low13 blocked by ARMR today1 not blocked147 Exploited4 Working exploit published9 Proof of concept only1 No public exploit134 2016401 Protected by Waratek3 No exploit published53 Outside Waratek scope6 Not applicable339 Critical54 High163 Medium170 Low14 blocked by ARMR today2 partly blocked1 not blocked398 Exploited3 Working exploit published16 Proof of concept only1 Forecast only2 No public exploit379 2017281 Protected by Waratek2 Mitigation candidate1 No exploit published22 Outside Waratek scope2 Not applicable254 Critical35 High140 Medium100 Low6 blocked by ARMR today2 not blocked279 Exploited3 Working exploit published12 Forecast only1 No public exploit265 201896 Protected by Waratek1 No exploit published2 Outside Waratek scope2 Not applicable91 Critical23 High35 Medium37 Low1 blocked by ARMR today1 not blocked95 Working exploit published2 No public exploit94 2019167 Protected by Waratek1 No exploit published2 Outside Waratek scope7 Not applicable157 Critical31 High65 Medium66 Low5 blocked by ARMR today1 not blocked166 Exploited3 Working exploit published3 No public exploit161 2020114 No exploit published3 Outside Waratek scope10 Not applicable101 Critical13 High38 Medium60 Low3 not blocked114 Exploited2 Working exploit published1 No public exploit111 2021157 No exploit published2 Outside Waratek scope8 Not applicable147 Critical24 High61 Medium71 Low1 not blocked157 Exploited5 Working exploit published4 Proof of concept only1 No public exploit147 2022362 Protected by Waratek3 No exploit published7 Outside Waratek scope4 Not applicable348 Critical37 High135 Medium174 Low16 blocked by ARMR today3 not blocked359 Exploited5 Working exploit published5 Proof of concept only40 No public exploit312 2023493 Protected by Waratek1 Mitigation candidate1 No exploit published41 Outside Waratek scope9 Not applicable441 Critical70 High228 Medium185 Low10 blocked by ARMR today1 not blocked492 Exploited20 Working exploit published7 Proof of concept only52 No public exploit414 2024785 Protected by Waratek3 Mitigation candidate1 No exploit published30 Outside Waratek scope8 Not applicable743 Critical101 High298 Medium359 Low27 blocked by ARMR today3 not blocked782 Exploited11 Working exploit published7 Proof of concept only155 No public exploit612 20251,253 Protected by Waratek3 No exploit published52 Outside Waratek scope8 Not applicable1,190 Critical132 High298 Medium615 Low208 blocked by ARMR today3 not blocked1,250 Exploited14 Working exploit published8 Proof of concept only580 No public exploit651 20264,645 Protected by Waratek3 No exploit published2,405 Outside Waratek scope11 Not applicable2,226 Critical680 High2,053 Medium1,563 Low346 Unknown3 blocked by ARMR today3 not blocked4,642 Exploited17 Working exploit published8 Proof of concept only652 No public exploit3,968
200220052008201120142017202020232026
8,953 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 90 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-91868 Medium 2026-11-13 Not applicable No public exploit IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.
CVE-2026-62977 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0.
CVE-2026-61417 Medium 2026-11-13 Not applicable No public exploit Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
CVE-2026-128078 Medium 2026-11-13 Not applicable No public exploit GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.
CVE-2026-127283 Medium 2026-11-13 Not applicable No public exploit A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.
CVE-2026-126440 Medium 2026-11-13 Not applicable Proof of concept only OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval.
CVE-2026-126435 Medium 2026-11-13 Not applicable No public exploit OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures.
CVE-2026-126417 Medium 2026-11-13 Not applicable No public exploit OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document.
CVE-2026-110178 Medium 2026-11-13 Not applicable No public exploit IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to improper access control in the bulk import path. A remote authenticated attacker holding a team-scoped `admin.import` permission can overwrite the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants by sending a crafted POST request to `/v1/import` with `conflict_strategy=update`, redirecting subsequent AI gateway invocations to an attacker-controlled host.
CVE-2026-124817 Medium 2026-11-12 Not applicable No public exploit The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.
CVE-2026-117550 High 2026-11-12 Not applicable No public exploit Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy.
CVE-2026-88813 Medium 2026-11-11 Not applicable No public exploit The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.
CVE-2026-76080 Low 2026-11-11 Not applicable No public exploit Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.
CVE-2026-126332 Unknown 2026-11-11 Not applicable No public exploit Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.
CVE-2026-126326 Unknown 2026-11-11 Not applicable No public exploit Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.
CVE-2026-123656 Medium 2026-11-11 Not applicable No public exploit The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.
CVE-2026-121873 Medium 2026-11-11 Not applicable No public exploit The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.
CVE-2026-117523 Medium 2026-11-11 Not applicable No public exploit The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide.
CVE-2026-110949 Low 2026-11-11 Not applicable No public exploit The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.
CVE-2026-110948 Low 2026-11-11 Not applicable No public exploit The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page.
CVE-2026-109871 Medium 2026-11-11 Not applicable No public exploit The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying.
CVE-2026-120983 Medium 2026-11-10 Not applicable No public exploit On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU.
CVE-2026-120780 High 2026-11-10 Not applicable No public exploit Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-119832 Medium 2026-11-10 Not applicable No public exploit Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack.
CVE-2026-119404 Medium 2026-11-10 Not applicable No public exploit Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-118736 Medium 2026-11-10 Not applicable No public exploit Improper access control in Windows Network File System allows an authorized attacker to disclose information locally.
CVE-2026-118208 High 2026-11-10 Not applicable No public exploit Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-118140 Medium 2026-11-10 Not applicable No public exploit Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.
CVE-2026-112809 Medium 2026-11-10 Not applicable No public exploit Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.
CVE-2026-112803 Medium 2026-11-10 Not applicable No public exploit Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.
CVE-2026-106025 Medium 2026-11-10 Not applicable No public exploit The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.
CVE-2026-124834 Medium 2026-11-09 Not applicable No public exploit A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
CVE-2026-124635 Medium 2026-11-09 Not applicable No public exploit A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVE-2026-124623 Low 2026-11-09 Not applicable No public exploit A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-124587 Low 2026-11-09 Not applicable Proof of concept only A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.
CVE-2026-124569 Medium 2026-11-09 Not applicable No public exploit A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-124568 Medium 2026-11-09 Not applicable No public exploit A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-124565 Medium 2026-11-09 Not applicable No public exploit A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulation leads to improper access controls. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-123129 Medium 2026-11-09 Not applicable No public exploit The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free. This is due to an incomplete fix of CVE-2026-34898.
CVE-2026-113971 Low 2026-11-09 Not applicable No public exploit This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.
CVE-2026-113960 Medium 2026-11-09 Not applicable No public exploit This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined.
CVE-2026-97192 Low 2026-11-08 Not applicable No public exploit The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
CVE-2026-2700 Medium 2026-11-08 Not applicable No public exploit IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.
CVE-2026-124458 High 2026-11-08 Not applicable Proof of concept only OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows patient-portal users to read any staff member's demographics by bypassing compartment enforcement. Attackers holding a patient SMART token with patient/Person.read can harvest staff Person UUIDs from Appointment references to retrieve names, home addresses, phone numbers, and personal emails.
CVE-2026-123603 Medium 2026-11-08 Not applicable No public exploit hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.
CVE-2026-114464 Critical 2026-11-08 Not applicable No public exploit IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.
CVE-2026-105970 Medium 2026-11-08 Not applicable No public exploit The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
CVE-2026-97191 Low 2026-11-07 Not applicable No public exploit The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
CVE-2026-123991 Medium 2026-11-07 Not applicable No public exploit A vulnerability was detected in DataEase up to 2.10.27. Affected by this vulnerability is the function WhitelistUtils.endsWithAny of the file WhitelistUtils.java of the component Authentication Filter. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.10.28 addresses this issue. It is advisable to upgrade the affected component. The vendor confirms: "This issue has been addressed by enforcing authentication on the standalone static-resource upload endpoint independently of the URI suffix whitelist."
CVE-2026-123881 Medium 2026-11-07 Not applicable Proof of concept only A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-49939 High 2026-11-06 Not applicable No public exploit In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
CVE-2026-123787 Low 2026-11-06 Not applicable Proof of concept only A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.
CVE-2026-118239 Medium 2026-11-06 Not applicable No public exploit The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
CVE-2026-103985 High 2026-11-06 Not applicable Proof of concept only FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.
CVE-2026-90965 Medium 2026-11-05 Not applicable No public exploit The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
CVE-2026-90964 Medium 2026-11-05 Not applicable No public exploit The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
CVE-2026-87856 Medium 2026-11-05 Not applicable No public exploit The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.
CVE-2026-122158 Low 2026-11-05 Not applicable Proof of concept only A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.4.4 and 3.0.0-alpha.4 can resolve this issue. The patch is named c798b513c3ab6e672a1678774720fbb282f4d0c6. It is recommended to upgrade the affected component.
CVE-2026-122154 Medium 2026-11-05 Not applicable No public exploit A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.
CVE-2026-115451 Medium 2026-11-05 Not applicable No public exploit Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.
CVE-2026-104867 Medium 2026-11-05 Not applicable Proof of concept only Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.
CVE-2026-104137 High 2026-11-05 Not applicable No public exploit OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.
CVE-2026-104136 High 2026-11-05 Not applicable Proof of concept only OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information. This issue is fixed in version 8.3.0.
CVE-2026-102927 Medium 2026-11-05 Not applicable No public exploit HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1.
CVE-2026-97693 Critical 2026-11-04 Not applicable No public exploit Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them.
CVE-2026-122047 Medium 2026-11-04 Not applicable Proof of concept only A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-122028 Low 2026-11-04 Not applicable Proof of concept only A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-121618 Medium 2026-11-04 Not applicable Proof of concept only A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory Quality Control. This manipulation causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-115257 Medium 2026-11-04 Not applicable No public exploit The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
CVE-2026-115241 Medium 2026-11-04 Not applicable No public exploit The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
CVE-2026-110282 Medium 2026-11-04 Not applicable No public exploit IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control.
CVE-2026-106000 Medium 2026-11-04 Not applicable No public exploit The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
CVE-2026-16900 High 2026-11-03 Not applicable No public exploit Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.
CVE-2026-13594 Critical 2026-11-03 Not applicable No public exploit Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
CVE-2026-121539 Medium 2026-11-03 Not applicable No public exploit A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.
CVE-2026-121509 Medium 2026-11-03 Not applicable Proof of concept only A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-121416 High 2026-11-03 Not applicable No public exploit SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.
CVE-2026-106991 High 2026-11-03 Not applicable Proof of concept only hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
CVE-2026-106004 Medium 2026-11-03 Not applicable No public exploit The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.
CVE-2026-28588 High 2026-11-02 Not applicable No public exploit In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-120503 Low 2026-11-02 Not applicable No public exploit A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.
CVE-2026-120323 Medium 2026-11-02 Not applicable Proof of concept only A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.
CVE-2026-115654 Medium 2026-11-02 Not applicable No public exploit In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them.
CVE-2026-0053 High 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-120233 Medium 2026-11-01 Not applicable Proof of concept only A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
CVE-2026-120192 Medium 2026-11-01 Not applicable Proof of concept only A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.
CVE-2026-118395 High 2026-11-01 Not applicable No public exploit Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.
CVE-2026-117646 Medium 2026-11-01 Not applicable No public exploit The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources (`public-only`). A holder of such a token could list the private repositories visible to the token's owner, and that user's stars and watches of private repositories. The API and the profile activity tab already applied the restriction. The impact is disclosure of repository names and metadata, not of repository content.
CVE-2026-117635 Medium 2026-11-01 Not applicable No public exploit The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.
CVE-2026-75882 High 2026-10-30 Not applicable No public exploit An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.
CVE-2026-61708 High 2026-10-30 Not applicable No public exploit SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data_store/data_store_routes.py` permits `customer_user` callers to choose `bucket_name` and `object_name` without an allowlist, tenant prefix, ownership check or content restriction. The only file check requires a nonempty filename. The operations in `backend/app/data_store/data_store_operations.py` create missing buckets and upsert objects, allowing existing objects belonging to any tenant to be overwritten. Targets include `sysmon-configs/<customer_code>/sysmon_config.xml` distributed to managed Windows endpoints, `copilot-case-report-templates/<name>` rendered server-side, and case evidence or forensic artifacts under `copilot-cases/<case_id>/<file>` and `velociraptor-artifacts/<agent_id>/<flow_id>/<file>`. A lowest-privilege user can tamper with cross-tenant evidence, blind endpoint telemetry, poison report templates for later code execution, plant data or exhaust storage. Sibling list, download and delete routes remain restricted to admin/analyst; the exposed operation is the upload write path. This issue is fixed in version 0.1.76.
CVE-2026-59387 High 2026-10-30 Not applicable No public exploit The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.   An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
CVE-2026-119620 Medium 2026-10-30 Not applicable Proof of concept only A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-115828 Critical 2026-10-30 Not applicable No public exploit In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
CVE-2025-8574 High 2026-10-30 Not applicable No public exploit The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.
CVE-2026-90867 High 2026-10-29 Not applicable No public exploit Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
CVE-2026-85007 Low 2026-10-29 Not applicable No public exploit The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.
CVE-2026-6877 Medium 2026-10-29 Not applicable No public exploit ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries.  We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
CVE-2026-51905 High 2026-10-29 Not applicable Proof of concept only TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution.
CVE-2026-51903 High 2026-10-29 Not applicable Proof of concept only SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.
‹ prev page 1 of 90 next ›