Overview 3,502 matches · 734 in Waratek scope · 3 protected · 23 exploited · 5 CISA KEV · 38 public PoC · 7 EPSS ≥ 0.5
3,502matches
734in Waratek scope21.0%
3protected0.1%
23exploited0.7%
5CISA KEV0.1%
38public PoC1.1%
7EPSS ≥ 0.50.2%
Protected by Waratek
3
0.1%
Rule in development
0
0.0%
Mitigation candidate
1
0.0%
No exploit published
730
20.8%
Outside Waratek scope
37
1.1%
Not applicable
2,731
78.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.1%
partly blocked
0
0.0%
not blocked
3,499
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 1,566 / year
20061
No exploit published1
Medium1
not blocked1
No public exploit1
20071
No exploit published1
Medium1
not blocked1
No public exploit1
20081
Not applicable1
Medium1
not blocked1
No public exploit1
20091
Not applicable1
Medium1
not blocked1
No public exploit1
20100
20111
No exploit published1
Medium1
not blocked1
No public exploit1
20125
No exploit published2
Not applicable3
Medium5
not blocked5
No public exploit5
20135
No exploit published4
Not applicable1
Medium5
not blocked5
No public exploit5
201414
No exploit published1
Not applicable13
Medium14
not blocked14
No public exploit14
201570
No exploit published5
Outside Waratek scope1
Not applicable64
Medium70
not blocked70
Exploited1
Working exploit published5
No public exploit64
2016170
No exploit published24
Outside Waratek scope1
Not applicable145
Medium170
not blocked170
Working exploit published7
No public exploit163
2017100
No exploit published14
Outside Waratek scope1
Not applicable85
Medium100
not blocked100
Working exploit published3
No public exploit97
201837
No exploit published1
Outside Waratek scope2
Not applicable34
Medium37
not blocked37
Working exploit published1
No public exploit36
201966
No exploit published2
Outside Waratek scope2
Not applicable62
Medium66
not blocked66
Working exploit published1
No public exploit65
202060
No exploit published3
Outside Waratek scope9
Not applicable48
Medium60
not blocked60
Exploited2
Working exploit published1
No public exploit57
202171
No exploit published1
Outside Waratek scope4
Not applicable66
Medium71
not blocked71
Exploited1
No public exploit70
2022174
Protected by Waratek1
No exploit published5
Not applicable168
Medium174
blocked by ARMR today1
not blocked173
Exploited1
Working exploit published1
Proof of concept only16
No public exploit156
2023185
Mitigation candidate1
No exploit published16
Outside Waratek scope4
Not applicable164
Medium185
not blocked185
Exploited6
Working exploit published2
Proof of concept only23
No public exploit154
2024359
Protected by Waratek1
No exploit published15
Outside Waratek scope6
Not applicable337
Medium359
blocked by ARMR today1
not blocked358
Exploited5
Proof of concept only68
No public exploit286
2025615
Protected by Waratek1
No exploit published36
Outside Waratek scope4
Not applicable574
Medium615
blocked by ARMR today1
not blocked614
Exploited6
Working exploit published2
Proof of concept only273
No public exploit334
20261,566
No exploit published598
Outside Waratek scope3
Not applicable965
Medium1,566
not blocked1,566
Exploited1
Working exploit published1
Proof of concept only247
No public exploit1,317
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-91868 | Medium | 2026-11-13 | Not applicable | No public exploit | IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due to improper access control. |
| CVE-2026-62977 | Medium | 2026-11-13 | Not applicable | No public exploit | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0. |
| CVE-2026-61417 | Medium | 2026-11-13 | Not applicable | No public exploit | Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. |
| CVE-2026-128078 | Medium | 2026-11-13 | Not applicable | No public exploit | GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9. |
| CVE-2026-127283 | Medium | 2026-11-13 | Not applicable | No public exploit | A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used. |
| CVE-2026-126440 | Medium | 2026-11-13 | Not applicable | Proof of concept only | OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval. |
| CVE-2026-126435 | Medium | 2026-11-13 | Not applicable | No public exploit | OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures. |
| CVE-2026-126417 | Medium | 2026-11-13 | Not applicable | No public exploit | OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document. |
| CVE-2026-123670 | Medium | 2026-11-13 | Not applicable | No public exploit | The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site. |
| CVE-2026-110178 | Medium | 2026-11-13 | Not applicable | No public exploit | IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to improper access control in the bulk import path. A remote authenticated attacker holding a team-scoped `admin.import` permission can overwrite the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants by sending a crafted POST request to `/v1/import` with `conflict_strategy=update`, redirecting subsequent AI gateway invocations to an attacker-controlled host. |
| CVE-2026-124817 | Medium | 2026-11-12 | Not applicable | No public exploit | The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users. |
| CVE-2026-88813 | Medium | 2026-11-11 | Not applicable | No public exploit | The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid. |
| CVE-2026-123656 | Medium | 2026-11-11 | Not applicable | No public exploit | The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API. |
| CVE-2026-121873 | Medium | 2026-11-11 | Not applicable | No public exploit | The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control. |
| CVE-2026-117523 | Medium | 2026-11-11 | Not applicable | No public exploit | The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide. |
| CVE-2026-109871 | Medium | 2026-11-11 | Not applicable | No public exploit | The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying. |
| CVE-2026-59606 | Medium | 2026-11-10 | Not applicable | No public exploit | In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify global reset registers from non-secure software due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-56909 | Medium | 2026-11-10 | Not applicable | No public exploit | In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-120983 | Medium | 2026-11-10 | Not applicable | No public exploit | On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU. |
| CVE-2026-119832 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack. |
| CVE-2026-119404 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-118736 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Network File System allows an authorized attacker to disclose information locally. |
| CVE-2026-118140 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally. |
| CVE-2026-112809 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally. |
| CVE-2026-112803 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-106025 | Medium | 2026-11-10 | Not applicable | No public exploit | The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata. |
| CVE-2026-124834 | Medium | 2026-11-09 | Not applicable | No public exploit | A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor. |
| CVE-2026-124635 | Medium | 2026-11-09 | Not applicable | No public exploit | A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. |
| CVE-2026-124569 | Medium | 2026-11-09 | Not applicable | No public exploit | A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-124568 | Medium | 2026-11-09 | Not applicable | No public exploit | A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-124565 | Medium | 2026-11-09 | Not applicable | No public exploit | A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulation leads to improper access controls. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-123129 | Medium | 2026-11-09 | Not applicable | No public exploit | The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free. This is due to an incomplete fix of CVE-2026-34898. |
| CVE-2026-113960 | Medium | 2026-11-09 | Not applicable | No public exploit | This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined. |
| CVE-2026-2700 | Medium | 2026-11-08 | Not applicable | No public exploit | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control. |
| CVE-2026-123603 | Medium | 2026-11-08 | Not applicable | No public exploit | hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients. |
| CVE-2026-105970 | Medium | 2026-11-08 | Not applicable | No public exploit | The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid. |
| CVE-2026-123991 | Medium | 2026-11-07 | Not applicable | No public exploit | A vulnerability was detected in DataEase up to 2.10.27. Affected by this vulnerability is the function WhitelistUtils.endsWithAny of the file WhitelistUtils.java of the component Authentication Filter. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.10.28 addresses this issue. It is advisable to upgrade the affected component. The vendor confirms: "This issue has been addressed by enforcing authentication on the standalone static-resource upload endpoint independently of the URI suffix whitelist." |
| CVE-2026-123881 | Medium | 2026-11-07 | Not applicable | Proof of concept only | A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-118239 | Medium | 2026-11-06 | Not applicable | No public exploit | The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier. |
| CVE-2026-90965 | Medium | 2026-11-05 | Not applicable | No public exploit | The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published. |
| CVE-2026-90964 | Medium | 2026-11-05 | Not applicable | No public exploit | The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site. |
| CVE-2026-87856 | Medium | 2026-11-05 | Not applicable | No public exploit | The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content. |
| CVE-2026-122154 | Medium | 2026-11-05 | Not applicable | No public exploit | A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response. |
| CVE-2026-115451 | Medium | 2026-11-05 | Not applicable | No public exploit | Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads. |
| CVE-2026-104867 | Medium | 2026-11-05 | Not applicable | Proof of concept only | Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0. |
| CVE-2026-102927 | Medium | 2026-11-05 | Not applicable | No public exploit | HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1. |
| CVE-2026-122047 | Medium | 2026-11-04 | Not applicable | Proof of concept only | A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. |
| CVE-2026-121618 | Medium | 2026-11-04 | Not applicable | Proof of concept only | A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory Quality Control. This manipulation causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2026-115257 | Medium | 2026-11-04 | Not applicable | No public exploit | The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster. |
| CVE-2026-115241 | Medium | 2026-11-04 | Not applicable | No public exploit | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database. |
| CVE-2026-110282 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control. |
| CVE-2026-106000 | Medium | 2026-11-04 | Not applicable | No public exploit | The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying. |
| CVE-2026-121539 | Medium | 2026-11-03 | Not applicable | No public exploit | A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component. |
| CVE-2026-121509 | Medium | 2026-11-03 | Not applicable | Proof of concept only | A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-106004 | Medium | 2026-11-03 | Not applicable | No public exploit | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status. |
| CVE-2026-120323 | Medium | 2026-11-02 | Not applicable | Proof of concept only | A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component. |
| CVE-2026-115654 | Medium | 2026-11-02 | Not applicable | No public exploit | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them. |
| CVE-2026-120233 | Medium | 2026-11-01 | Not applicable | Proof of concept only | A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance. |
| CVE-2026-120192 | Medium | 2026-11-01 | Not applicable | Proof of concept only | A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded. |
| CVE-2026-117646 | Medium | 2026-11-01 | Not applicable | No public exploit | The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources (`public-only`). A holder of such a token could list the private repositories visible to the token's owner, and that user's stars and watches of private repositories. The API and the profile activity tab already applied the restriction. The impact is disclosure of repository names and metadata, not of repository content. |
| CVE-2026-117635 | Medium | 2026-11-01 | Not applicable | No public exploit | The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API. |
| CVE-2026-119620 | Medium | 2026-10-30 | Not applicable | Proof of concept only | A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-6877 | Medium | 2026-10-29 | Not applicable | No public exploit | ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so. |
| CVE-2026-51902 | Medium | 2026-10-29 | Not applicable | Proof of concept only | SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization. |
| CVE-2026-119317 | Medium | 2026-10-29 | Not applicable | No public exploit | On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself. |
| CVE-2026-119251 | Medium | 2026-10-29 | Not applicable | No public exploit | A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device. |
| CVE-2026-107035 | Medium | 2026-10-29 | Not applicable | Proof of concept only | Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload. |
| CVE-2026-118662 | Medium | 2026-10-28 | Not applicable | No public exploit | Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5. |
| CVE-2026-115255 | Medium | 2026-10-28 | Not applicable | No public exploit | The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members. |
| CVE-2026-106484 | Medium | 2026-10-28 | Not applicable | No public exploit | Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium) |
| CVE-2026-106003 | Medium | 2026-10-28 | Not applicable | No public exploit | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration. |
| CVE-2026-103382 | Medium | 2026-10-28 | Not applicable | No public exploit | The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method. |
| CVE-2026-90730 | Medium | 2026-10-27 | Not applicable | No public exploit | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. |
| CVE-2026-82986 | Medium | 2026-10-27 | Not applicable | No public exploit | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. |
| CVE-2026-82984 | Medium | 2026-10-27 | Not applicable | No public exploit | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers. |
| CVE-2026-77173 | Medium | 2026-10-27 | Not applicable | No public exploit | A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential. |
| CVE-2026-117512 | Medium | 2026-10-27 | Not applicable | Proof of concept only | A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-116809 | Medium | 2026-10-27 | Not applicable | No public exploit | OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes. |
| CVE-2026-86990 | Medium | 2026-10-26 | Not applicable | No public exploit | An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. A malicious app may be able to access the camera without user permission. |
| CVE-2026-86984 | Medium | 2026-10-26 | Not applicable | No public exploit | A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access information about a user's contacts. |
| CVE-2026-86880 | Medium | 2026-10-26 | Not applicable | No public exploit | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data. |
| CVE-2026-84614 | Medium | 2026-10-26 | Not applicable | No public exploit | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An attacker with physical access may be able to access contacts from the lock screen. |
| CVE-2026-84594 | Medium | 2026-10-26 | Not applicable | No public exploit | A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data. |
| CVE-2026-84542 | Medium | 2026-10-26 | Not applicable | No public exploit | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to read files outside of its sandbox. |
| CVE-2026-116507 | Medium | 2026-10-26 | Not applicable | Proof of concept only | A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. |
| CVE-2026-116284 | Medium | 2026-10-26 | Not applicable | Proof of concept only | A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-116283 | Medium | 2026-10-26 | Not applicable | No public exploit | A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised. |
| CVE-2026-116282 | Medium | 2026-10-26 | Not applicable | No public exploit | A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-116281 | Medium | 2026-10-26 | Not applicable | Proof of concept only | A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended. |
| CVE-2026-116122 | Medium | 2026-10-26 | Not applicable | No public exploit | A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way. |
| CVE-2026-116106 | Medium | 2026-10-26 | Not applicable | No public exploit | A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-112624 | Medium | 2026-10-26 | Not applicable | No public exploit | This issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to bypass Privacy preferences. |
| CVE-2026-112618 | Medium | 2026-10-26 | Not applicable | No public exploit | An access issue was addressed with improved access restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to access sensitive user data. |
| CVE-2026-112557 | Medium | 2026-10-26 | Not applicable | No public exploit | The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to bypass Privacy preferences. |
| CVE-2026-103381 | Medium | 2026-10-26 | Not applicable | No public exploit | The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information. |
| CVE-2026-103298 | Medium | 2026-10-26 | Not applicable | No public exploit | The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment. |
| CVE-2013-10077 | Medium | 2026-10-26 | Not applicable | No public exploit | A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases. |
| CVE-2026-87835 | Medium | 2026-10-24 | Not applicable | No public exploit | The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating. |
| CVE-2026-15261 | Medium | 2026-10-21 | Not applicable | No public exploit | The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists. |
| CVE-2026-114262 | Medium | 2026-10-21 | Not applicable | Proof of concept only | A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. |