Overview 11,934 matches · 487 in Waratek scope · 3 protected · 219 exploited · 13 CISA KEV · 183 public PoC · 34 EPSS ≥ 0.5
11,934matches
487in Waratek scope4.1%
3protected0.0%
219exploited1.8%
13CISA KEV0.1%
183public PoC1.5%
34EPSS ≥ 0.50.3%
Protected by Waratek
3
0.0%
Rule in development
0
0.0%
Mitigation candidate
10
0.1%
No exploit published
474
4.0%
Outside Waratek scope
22
0.2%
Not applicable
11,424
95.7%
Withdrawn CVE
1
0.0%
blocked by ARMR today
3
0.0%
partly blocked
0
0.0%
not blocked
11,931
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 5,426 / year
20051
Not applicable1
Medium1
not blocked1
No public exploit1
20062
No exploit published1
Not applicable1
High1
Medium1
not blocked2
No public exploit2
20070
20080
20094
Not applicable4
High2
Medium2
not blocked4
No public exploit4
20101
No exploit published1
Medium1
not blocked1
No public exploit1
20110
20121
Not applicable1
Medium1
not blocked1
No public exploit1
20130
20140
20150
20162
Not applicable2
High2
not blocked2
No public exploit2
201743
No exploit published4
Outside Waratek scope1
Not applicable38
Critical5
High23
Medium11
Low4
not blocked43
Exploited1
Working exploit published4
Proof of concept only1
No public exploit37
201867
No exploit published8
Not applicable59
Critical10
High35
Medium22
not blocked67
Exploited2
Working exploit published2
No public exploit63
2019211
Protected by Waratek1
No exploit published54
Outside Waratek scope1
Not applicable154
Withdrawn CVE1
Critical17
High77
Medium110
Low6
Unknown1
blocked by ARMR today1
not blocked210
Exploited3
Working exploit published10
Forecast only1
No public exploit197
2020278
No exploit published28
Outside Waratek scope1
Not applicable249
Critical24
High106
Medium139
Low9
not blocked278
Exploited7
Working exploit published5
Proof of concept only1
No public exploit265
2021269
No exploit published28
Outside Waratek scope7
Not applicable234
Critical37
High104
Medium120
Low8
not blocked269
Exploited16
Working exploit published7
No public exploit246
2022520
Mitigation candidate2
No exploit published106
Outside Waratek scope1
Not applicable411
Critical31
High180
Medium281
Low28
not blocked520
Exploited18
Working exploit published11
Proof of concept only29
No public exploit462
2023845
Mitigation candidate1
No exploit published61
Not applicable783
Critical47
High227
Medium556
Low15
not blocked845
Exploited28
Working exploit published6
Proof of concept only61
No public exploit750
20241,909
Mitigation candidate2
No exploit published31
Outside Waratek scope5
Not applicable1,871
Critical167
High467
Medium1,257
Low18
not blocked1,909
Exploited67
Working exploit published13
Proof of concept only82
Forecast only2
No public exploit1,745
20252,355
Mitigation candidate4
No exploit published31
Outside Waratek scope3
Not applicable2,317
Critical105
High429
Medium1,746
Low75
not blocked2,355
Exploited31
Working exploit published11
Proof of concept only143
No public exploit2,170
20265,426
Protected by Waratek2
Mitigation candidate1
No exploit published121
Outside Waratek scope3
Not applicable5,299
Critical328
High1,536
Medium3,306
Low250
None2
Unknown4
blocked by ARMR today2
not blocked5,424
Exploited46
Working exploit published29
Proof of concept only932
No public exploit4,419
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-65965 | High | 2026-11-11 | Not applicable | Proof of concept only | ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. The most severe is POST /api/projects/[id]/graph, which deletes every block and link in the project and re-inserts client-supplied ones. A viewer can silently rewrite or wipe the entire canvas of a project they were invited to read. The application clearly intends viewer to be read-only: the collaborators endpoint, the automation endpoints, and the realtime Yjs sync path all reject write attempts from viewers. These specific HTTP handlers simply omit the guard their siblings enforce. This issue has been patched in version 0.9.4. |
| CVE-2026-14242 | Medium | 2026-11-11 | Not applicable | No public exploit | A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization). |
| CVE-2026-126896 | High | 2026-11-11 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126875 | High | 2026-11-11 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126855 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126809 | Medium | 2026-11-11 | Not applicable | No public exploit | WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter. |
| CVE-2026-126662 | High | 2026-11-11 | Not applicable | No public exploit | Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download. |
| CVE-2026-126561 | High | 2026-11-11 | Not applicable | Proof of concept only | Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely. |
| CVE-2026-126545 | Medium | 2026-11-11 | Not applicable | Proof of concept only | WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing. |
| CVE-2026-126225 | High | 2026-11-11 | Not applicable | No public exploit | A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request. |
| CVE-2026-125782 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.2. |
| CVE-2026-125776 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6. |
| CVE-2026-125763 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0. |
| CVE-2026-125448 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.31. |
| CVE-2026-125444 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through 51.1.87. |
| CVE-2026-125439 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0. |
| CVE-2026-125438 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235. |
| CVE-2026-125437 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.13.0. |
| CVE-2026-125436 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Post Grid: from n/a through 7.9.9. |
| CVE-2026-125434 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235. |
| CVE-2026-125431 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7. |
| CVE-2026-125046 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1. |
| CVE-2026-124753 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. |
| CVE-2026-124421 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in BdThemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through 2.8.2. |
| CVE-2026-124417 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. |
| CVE-2026-124416 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. |
| CVE-2026-124413 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4. |
| CVE-2026-124408 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22. |
| CVE-2026-124271 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3. |
| CVE-2026-124269 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0. |
| CVE-2026-124261 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.7. |
| CVE-2026-123703 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request. |
| CVE-2026-123702 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline. |
| CVE-2026-123701 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall. |
| CVE-2026-123700 | High | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes. |
| CVE-2026-123699 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16, and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site. |
| CVE-2026-123698 | Medium | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL. |
| CVE-2026-123697 | High | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available. |
| CVE-2026-123696 | High | 2026-11-11 | Not applicable | No public exploit | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once. |
| CVE-2026-123661 | Medium | 2026-11-11 | Not applicable | No public exploit | The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role. |
| CVE-2026-123657 | Medium | 2026-11-11 | Not applicable | No public exploit | The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them. |
| CVE-2026-123481 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2. |
| CVE-2026-122671 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through 1.32.65. |
| CVE-2026-122300 | Unknown | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry. Users are recommended to upgrade to Apache Roller 6.1.7 or later. |
| CVE-2026-121574 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20. |
| CVE-2026-121014 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. |
| CVE-2026-119303 | Medium | 2026-11-11 | Not applicable | No public exploit | The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server. |
| CVE-2026-119302 | Medium | 2026-11-11 | Not applicable | Working exploit published | The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request. |
| CVE-2026-119032 | Medium | 2026-11-11 | Not applicable | No public exploit | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta. |
| CVE-2026-118408 | Low | 2026-11-11 | Not applicable | No public exploit | Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries. |
| CVE-2026-116468 | Medium | 2026-11-11 | No exploit published | No public exploit | A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm. |
| CVE-2026-115600 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3. |
| CVE-2026-106468 | Low | 2026-11-11 | Not applicable | No public exploit | The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network. |
| CVE-2026-105440 | High | 2026-11-11 | Not applicable | No public exploit | Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11. Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure. |
| CVE-2026-100307 | High | 2026-11-11 | Not applicable | No public exploit | Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request. To remediate this issue, users should upgrade to version 1.25.0. |
| CVE-2026-96845 | High | 2026-11-10 | Not applicable | No public exploit | Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96133 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| CVE-2026-96029 | High | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-89128 | Medium | 2026-11-10 | Not applicable | No public exploit | Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected. |
| CVE-2026-89114 | High | 2026-11-10 | Not applicable | No public exploit | SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability. |
| CVE-2026-88176 | High | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-86336 | Unknown | 2026-11-10 | No exploit published | No public exploit | Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-126123 | High | 2026-11-10 | Not applicable | No public exploit | BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data. |
| CVE-2026-125750 | High | 2026-11-10 | Not applicable | No public exploit | Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push. |
| CVE-2026-125745 | Low | 2026-11-10 | Not applicable | No public exploit | Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wck_show_update_form AJAX handler, which lacks the capability checks enforced by other handlers and relies on a shared, non-unique nonce action. Attackers can send a crafted admin-ajax.php request with a valid wck-edit-entry nonce, a target meta key, and an arbitrary post ID to disclose sensitive post-meta or option values belonging to other users, including private or draft post data. |
| CVE-2026-125652 | Medium | 2026-11-10 | No exploit published | No public exploit | A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier. |
| CVE-2026-125398 | High | 2026-11-10 | Not applicable | Proof of concept only | Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors. |
| CVE-2026-125388 | High | 2026-11-10 | Not applicable | Proof of concept only | Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see. |
| CVE-2026-125378 | Medium | 2026-11-10 | Not applicable | Proof of concept only | PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it. |
| CVE-2026-125377 | High | 2026-11-10 | Not applicable | No public exploit | Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types. |
| CVE-2026-125337 | High | 2026-11-10 | Not applicable | No public exploit | Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14. |
| CVE-2026-125331 | Critical | 2026-11-10 | Not applicable | No public exploit | HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8. |
| CVE-2026-125297 | Critical | 2026-11-10 | Not applicable | No public exploit | AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41. |
| CVE-2026-125077 | Low | 2026-11-10 | Not applicable | Proof of concept only | A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. |
| CVE-2026-12266 | High | 2026-11-10 | Not applicable | No public exploit | Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API. |
| CVE-2026-121668 | High | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network. |
| CVE-2026-121191 | Medium | 2026-11-10 | Not applicable | No public exploit | Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects eta-remote: from 0.0.2 before 0.0.3. |
| CVE-2026-120825 | High | 2026-11-10 | Not applicable | Proof of concept only | An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material. |
| CVE-2026-120823 | Low | 2026-11-10 | Not applicable | No public exploit | A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information. |
| CVE-2026-120805 | Low | 2026-11-10 | Not applicable | No public exploit | In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations. |
| CVE-2026-120286 | Medium | 2026-11-10 | Not applicable | Proof of concept only | Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member. A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to. This issue affects nerves_hub: from 1.0.0 before 2.5.3. |
| CVE-2026-119899 | High | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119883 | Low | 2026-11-10 | Not applicable | No public exploit | Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally. |
| CVE-2026-119852 | Medium | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119827 | High | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119396 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows Remote Access API allows an authorized attacker to perform tampering locally. |
| CVE-2026-118740 | Critical | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-113822 | Medium | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-113773 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-112977 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper privilege management in Windows Deployment Services allows an authorized attacker to disclose information locally. |
| CVE-2026-112974 | Medium | 2026-11-10 | Not applicable | No public exploit | Improper access control in Microsoft Account allows an authorized attacker to perform tampering locally. |
| CVE-2026-112802 | High | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-111239 | Unknown | 2026-11-10 | No exploit published | No public exploit | The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users. |
| CVE-2026-109809 | Medium | 2026-11-10 | Not applicable | No public exploit | SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on integrity, with no impact on confidentiality and availability of the application. |
| CVE-2026-109808 | Low | 2026-11-10 | Not applicable | No public exploit | Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must have prior knowledge of specific internal identifiers to successfully target the affected functionality. Successful exploitation could allow the attacker to read sensitive information, resulting in a low impact on confidentiality. There is no impact on integrity and availability. |
| CVE-2026-109495 | Medium | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-109466 | High | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network. |
| CVE-2026-102230 | High | 2026-11-10 | Not applicable | No public exploit | Missing authorization in Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-94249 | High | 2026-11-09 | Not applicable | No public exploit | Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse. This issue affects Liderahenk: before 2.0.3. |
| CVE-2026-81422 | Medium | 2026-11-09 | Not applicable | No public exploit | The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site. |