WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-863✕
Overview 5,064 matches · 365 in Waratek scope · 6 protected · 64 exploited · 23 CISA KEV · 113 public PoC · 27 EPSS ≥ 0.5
5,064matches 365in Waratek scope7.2% 6protected0.1% 64exploited1.3% 23CISA KEV0.5% 113public PoC2.2% 27EPSS ≥ 0.50.5%
Protected by Waratek 6 0.1% Rule in development 0 0.0% Mitigation candidate 10 0.2% No exploit published 349 6.9% Outside Waratek scope 43 0.8% Not applicable 4,656 91.9% Withdrawn CVE 0 0.0%
Critical 539 10.6% High 1,886 37.2% Medium 2,331 46.0% Low 302 6.0% None 0 0.0% Unknown 6 0.1%
blocked by ARMR today 6 0.1% partly blocked 0 0.0% not blocked 5,058 99.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 64 1.3% Working exploit published 49 1.0% Proof of concept only 826 16.3% Forecast only 3 0.1% No public exploit 4,122 81.4%
split by peak 2,604 / year
Not applicable: 4,656Outside Waratek scope: 43No exploit published: 349Mitigation candidate: 10Protected by Waratek: 6 Unknown: 6Low: 302Medium: 2,331High: 1,886Critical: 539 not blocked: 5,058blocked by ARMR today: 6 No public exploit: 4,122Forecast only: 3Proof of concept only: 826Working exploit published: 49Exploited: 64
20011 Not applicable1 Critical1 not blocked1 No public exploit1 20020 20030 20040 20051 Not applicable1 Medium1 not blocked1 No public exploit1 20061 Not applicable1 High1 not blocked1 No public exploit1 20073 No exploit published1 Not applicable2 High2 Medium1 not blocked3 Working exploit published1 No public exploit2 20083 Not applicable3 High2 Medium1 not blocked3 No public exploit3 20094 Not applicable4 Critical1 High1 Medium2 not blocked4 No public exploit4 20102 Not applicable2 Critical1 High1 not blocked2 Forecast only1 No public exploit1 20112 Not applicable2 High2 not blocked2 No public exploit2 20121 Not applicable1 Medium1 not blocked1 No public exploit1 20133 Outside Waratek scope1 Not applicable2 High1 Medium2 not blocked3 No public exploit3 20142 Outside Waratek scope1 Not applicable1 Medium2 not blocked2 No public exploit2 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20165 No exploit published3 Not applicable2 High2 Medium3 not blocked5 No public exploit5 201731 No exploit published1 Outside Waratek scope4 Not applicable26 Critical5 High15 Medium11 not blocked31 Working exploit published1 No public exploit30 2018110 No exploit published21 Outside Waratek scope7 Not applicable82 Critical7 High44 Medium58 Low1 not blocked110 Exploited2 Working exploit published4 No public exploit104 2019126 No exploit published11 Outside Waratek scope4 Not applicable111 Critical19 High52 Medium53 Low2 not blocked126 Exploited5 Working exploit published8 Proof of concept only1 No public exploit112 2020186 No exploit published17 Outside Waratek scope6 Not applicable163 Critical17 High81 Medium82 Low6 not blocked186 Exploited1 Working exploit published2 Proof of concept only2 Forecast only1 No public exploit180 2021306 Protected by Waratek3 Mitigation candidate3 No exploit published28 Outside Waratek scope7 Not applicable265 Critical38 High114 Medium151 Low3 blocked by ARMR today3 not blocked303 Exploited13 Working exploit published8 Proof of concept only2 No public exploit283 2022300 Mitigation candidate3 No exploit published24 Outside Waratek scope3 Not applicable270 Critical46 High99 Medium148 Low7 not blocked300 Exploited7 Working exploit published8 Proof of concept only35 No public exploit250 2023431 Protected by Waratek1 Mitigation candidate1 No exploit published28 Outside Waratek scope4 Not applicable397 Critical59 High184 Medium180 Low8 blocked by ARMR today1 not blocked430 Exploited12 Working exploit published5 Proof of concept only70 Forecast only1 No public exploit343 2024427 Protected by Waratek2 Mitigation candidate2 No exploit published41 Outside Waratek scope5 Not applicable377 Critical70 High165 Medium182 Low10 blocked by ARMR today2 not blocked425 Exploited8 Working exploit published2 Proof of concept only65 No public exploit352 2025514 Mitigation candidate1 No exploit published54 Not applicable459 Critical42 High132 Medium283 Low57 not blocked514 Exploited7 Working exploit published4 Proof of concept only86 No public exploit417 20262,604 No exploit published120 Outside Waratek scope1 Not applicable2,483 Critical233 High988 Medium1,169 Low208 Unknown6 not blocked2,604 Exploited9 Working exploit published6 Proof of concept only565 No public exploit2,024
200220052008201120142017202020232026
5,064 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 51 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-120826 High 2026-11-10 Not applicable No public exploit An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.
CVE-2026-120822 High 2026-11-10 Not applicable Proof of concept only MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.
CVE-2026-120816 Low 2026-11-10 Not applicable No public exploit A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents of certain restricted internal collections that the same user is refused on a direct read. The privilege check for the notification feature is derived only from the target namespace and does not account for the option, so no additional permission is required. This may result in unintended access to data stored in those internal collections.
CVE-2026-120815 High 2026-11-10 Not applicable Proof of concept only An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.
CVE-2026-120782 High 2026-11-10 Not applicable No public exploit Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-120295 High 2026-11-10 Not applicable Proof of concept only Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter. A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
CVE-2026-120002 Critical 2026-11-10 Not applicable No public exploit Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-119985 High 2026-11-10 Not applicable No public exploit Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-119982 Medium 2026-11-10 Not applicable No public exploit Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-119892 High 2026-11-10 Not applicable No public exploit Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-119818 High 2026-11-10 Not applicable No public exploit Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
CVE-2026-119017 Critical 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-118148 High 2026-11-10 Not applicable No public exploit Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
CVE-2026-118146 High 2026-11-10 Not applicable No public exploit Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.
CVE-2026-118137 High 2026-11-10 Not applicable No public exploit Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally.
CVE-2026-118108 High 2026-11-10 Not applicable No public exploit Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-116714 High 2026-11-10 Not applicable No public exploit Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
CVE-2026-114371 Critical 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-114162 Critical 2026-11-10 Not applicable No public exploit Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.
CVE-2026-114146 Critical 2026-11-10 Not applicable No public exploit Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-113754 Medium 2026-11-10 Not applicable No public exploit Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.
CVE-2026-113560 High 2026-11-10 Not applicable No public exploit Audition is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-113422 High 2026-11-10 Not applicable No public exploit In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update targets a Wire Component, Driver or Asset from the factory identifier supplied in the request, instead of the actual factory of the existing component. An authenticated identity holding only the Wires management permission (kura.wires.admin for the Web UI, rest.wires.admin for the REST API) can therefore modify the configuration of existing components that are not part of the Wire Graph, including security-relevant ones, or replace existing components. This allows escalation to full administrative privileges and can disrupt the device. Modifying arbitrary components requires at least one Driver to be installed on the device. The issue is fixed in Eclipse Kura 5.6.3.
CVE-2026-112973 High 2026-11-10 Not applicable No public exploit Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.
CVE-2026-112191 High 2026-11-10 Not applicable No public exploit In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3.
CVE-2026-112185 High 2026-11-10 Not applicable No public exploit In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the rest.configuration permission can read the password hashes of all identities, including administrators, which are stored as unsalted SHA-256 digests. The same identity can also modify identities and permission assignments, and restore previous configuration snapshots, which allows escalation to full administrative privileges. The issue is fixed in Eclipse Kura 5.6.3.
CVE-2026-111258 Unknown 2026-11-10 No exploit published No public exploit The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-111247 Unknown 2026-11-10 No exploit published No public exploit When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-111244 Unknown 2026-11-10 No exploit published No public exploit When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-109455 Medium 2026-11-10 Not applicable No public exploit Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-108167 Unknown 2026-11-10 Not applicable No public exploit The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
CVE-2026-107372 Unknown 2026-11-10 Not applicable No public exploit The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
CVE-2026-105986 High 2026-11-10 Not applicable No public exploit Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate  privileges via a percent-encoded role name or a self-assigned role.
CVE-2026-105501 High 2026-11-10 Not applicable No public exploit Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-92683 High 2026-11-09 Not applicable No public exploit Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.
CVE-2026-87857 Medium 2026-11-09 Not applicable No public exploit Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace's workflow history, provided the supplied workflow identifier selects the same History shard as the continuation's branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller's current credential no longer granted access to the continuation's namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token's branch token is not the requested execution's current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading "Pagination branch token is not the execution's current branch token" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state.
CVE-2026-124502 Low 2026-11-09 Not applicable Proof of concept only A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.
CVE-2026-123803 High 2026-11-09 Not applicable No public exploit SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
CVE-2026-123800 Critical 2026-11-09 Not applicable No public exploit SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
CVE-2026-123131 Medium 2026-11-09 Not applicable No public exploit The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.
CVE-2026-121874 High 2026-11-09 Not applicable No public exploit The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.
CVE-2026-118196 Critical 2026-11-09 Not applicable No public exploit OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.
CVE-2026-115337 Medium 2026-11-09 Not applicable No public exploit Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.
CVE-2026-113963 Medium 2026-11-09 Not applicable No public exploit An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iPadOS 27.2.1, tvOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data.
CVE-2026-113961 High 2026-11-09 Not applicable No public exploit An authorization issue was addressed with improved validation. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages.
CVE-2026-111455 Medium 2026-11-09 Not applicable No public exploit Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.
CVE-2026-111453 Medium 2026-11-09 Not applicable No public exploit Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.
CVE-2026-18093 High 2026-11-08 Not applicable No public exploit IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.
CVE-2026-14469 Medium 2026-11-08 Not applicable No public exploit IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization.
CVE-2026-124487 High 2026-11-08 Not applicable Proof of concept only OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data.
CVE-2026-124483 High 2026-11-08 Not applicable Proof of concept only OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.
CVE-2026-124441 High 2026-11-08 Not applicable Proof of concept only Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged background-controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.
CVE-2026-124436 High 2026-11-08 Not applicable Proof of concept only OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.
CVE-2026-124433 High 2026-11-08 Not applicable Proof of concept only phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.
CVE-2026-123527 Medium 2026-11-08 Not applicable Proof of concept only Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.
CVE-2026-123524 Medium 2026-11-08 Not applicable Proof of concept only Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task.
CVE-2026-123506 Medium 2026-11-08 Not applicable No public exploit Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.
CVE-2026-110132 Medium 2026-11-08 Not applicable No public exploit The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship.
CVE-2026-18689 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
CVE-2026-17378 High 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17373 High 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CVE-2026-17343 High 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.
CVE-2026-16711 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.
CVE-2026-123218 Critical 2026-11-07 Not applicable Exploited IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
CVE-2026-121857 Medium 2026-11-07 Not applicable No public exploit The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
CVE-2026-118530 Medium 2026-11-07 Not applicable No public exploit The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.
CVE-2026-118529 Low 2026-11-07 Not applicable No public exploit The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.
CVE-2026-118267 High 2026-11-07 Not applicable Exploited The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.
CVE-2026-85744 Medium 2026-11-06 Not applicable No public exploit FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.
CVE-2026-63017 Critical 2026-11-06 Not applicable No public exploit Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
CVE-2026-124026 Medium 2026-11-06 Not applicable Proof of concept only Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.
CVE-2026-123852 High 2026-11-06 Not applicable No public exploit In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
CVE-2026-123334 Low 2026-11-06 Not applicable No public exploit In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
CVE-2026-123333 Low 2026-11-06 Not applicable No public exploit In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
CVE-2026-123328 Medium 2026-11-06 Not applicable No public exploit In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
CVE-2026-123326 High 2026-11-06 Not applicable No public exploit In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
CVE-2026-123324 High 2026-11-06 Not applicable No public exploit In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
CVE-2026-123299 Low 2026-11-06 Not applicable No public exploit In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
CVE-2026-123296 High 2026-11-06 Not applicable No public exploit In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
CVE-2026-123295 High 2026-11-06 Not applicable No public exploit In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
CVE-2026-123289 Medium 2026-11-06 Not applicable No public exploit In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
CVE-2026-123287 High 2026-11-06 Not applicable No public exploit In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
CVE-2026-123286 Medium 2026-11-06 Not applicable No public exploit In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
CVE-2026-123284 Medium 2026-11-06 Not applicable No public exploit In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
CVE-2026-123280 Critical 2026-11-06 Not applicable No public exploit In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
CVE-2026-123279 Critical 2026-11-06 Not applicable No public exploit In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
CVE-2026-121837 Medium 2026-11-06 Not applicable No public exploit A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.
CVE-2026-118514 Medium 2026-11-06 Not applicable No public exploit In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and RequestMatcher\MethodRequestMatcher which replaces it from 6.2.x on, matches a request against a list of HTTP methods. These compared the request method to the list verbatim, while the router serves a HEAD request with the GET handler, as HTTP semantics require. This came after the incomplete fix of  CVE-2026-45075 https://github.com/advisories/GHSA-6439-2f28-8p8q , which addressed the same gap in the #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] attributes only. Security rules configured to apply only to GET requests could therefore be bypassed by sending a HEAD request to the same URL. Although HEAD responses contain no body, attackers could still access response headers and trigger the controller's execution, including any side effects. This issue also affects firewalls configured with methods: [GET]. A HEAD request would not match that firewall and could instead be handled by another matching firewall or no firewall at all. Applications using these vulnerable request matchers directly, including through a custom firewall request_matcher, could also be affected. The issue affects symfony/http-foundation through v5.4.55, v6.x through 6.4.49, v7.x through v7.4.22, and v8.x through v8.1.10.
CVE-2026-118186 Medium 2026-11-06 Not applicable No public exploit The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.
CVE-2026-118167 Medium 2026-11-06 Not applicable No public exploit The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
CVE-2026-112340 High 2026-11-06 Not applicable Proof of concept only Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
CVE-2026-88984 High 2026-11-05 Not applicable No public exploit Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a modified pipeline is a conditional downstream consequence. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not remediated by version 2.16.1. This issue is fixed in version 2.16.1.
CVE-2026-85076 Critical 2026-11-05 Not applicable No public exploit Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.
CVE-2026-84728 Medium 2026-11-05 Not applicable No public exploit Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostname mapped to a different tenant: ContextFilter resolves the tenant from the hostname via TenantDomainName, but LoginWorker gives priority to the conflicting userTenantId request parameter and authenticates against the attacker's own tenant, so a subsequent ordinary request to the same hostname combines the hostname-mapped tenant's Entity Engine delegator with the attacker's tenant's session dispatcher, security object, and identity, letting the permission check run against the attacker's own tenant while the resulting read or write is performed against the hostname-mapped tenant's data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-84183 High 2026-11-05 Not applicable No public exploit Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-69144 Medium 2026-11-05 Not applicable No public exploit SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean; the revision is then resolved and served without checking its parent document. A low-privileged authenticated user can use this identifier confusion to download administrator-owned or otherwise protected documents. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-63218 Medium 2026-11-05 Not applicable No public exploit SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The affected flow begins at AOR_Reports and uses changeReportPage, and DetailView to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can directly invoke the action and read report rows and restricted-module data despite owner-only or role-based report visibility. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-123184 High 2026-11-05 Not applicable No public exploit An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project's git repository. Read access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected.
CVE-2026-123023 Medium 2026-11-05 Not applicable No public exploit A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component.
CVE-2026-122307 High 2026-11-05 Not applicable No public exploit Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement.
‹ prev page 2 of 51 next ›